Skip to content

Commit d0e260c

Browse files
stlazstlaz
committed
test-cmd/e2e/integration: add scopes to oauth access tokens/clients
1 parent 884e78e commit d0e260c

6 files changed

Lines changed: 91 additions & 90 deletions

File tree

‎test/integration/etcd_storage_path_test.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -112,27 +112,27 @@ var openshiftEtcdStorageData = map[schema.GroupVersionResource]etcddata.StorageD
112112
},
113113
},
114114
gvr("oauth.openshift.io", "v1", "oauthaccesstokens"): {
115-
Stub: `{"clientName": "client1g", "metadata": {"name": "tokenneedstobelongenoughelseitwontworkg"}, "userName": "user", "userUID": "cannot be empty"}`,
115+
Stub: `{"clientName": "client1g", "metadata": {"name": "tokenneedstobelongenoughelseitwontworkg"}, "userName": "user", "scopes": ["user:info"], "redirectURI": "https://something.com/", "userUID": "cannot be empty"}`,
116116
ExpectedEtcdPath: "openshift.io/oauth/accesstokens/tokenneedstobelongenoughelseitwontworkg",
117117
Prerequisites: []etcddata.Prerequisite{
118118
{
119119
GvrData: gvr("oauth.openshift.io", "v1", "oauthclients"),
120-
Stub: `{"metadata": {"name": "client1g"}}`,
120+
Stub: `{"metadata": {"name": "client1g"}, "grantMethod": "prompt"}`,
121121
},
122122
},
123123
},
124124
gvr("oauth.openshift.io", "v1", "oauthauthorizetokens"): {
125-
Stub: `{"clientName": "client0g", "metadata": {"name": "tokenneedstobelongenoughelseitwontworkg"}, "userName": "user", "userUID": "cannot be empty", "expiresIn": 86400}`,
125+
Stub: `{"clientName": "client0g", "metadata": {"name": "tokenneedstobelongenoughelseitwontworkg"}, "userName": "user", "scopes": ["user:info"], "redirectURI": "https://something.com/", "userUID": "cannot be empty", "expiresIn": 86400}`,
126126
ExpectedEtcdPath: "openshift.io/oauth/authorizetokens/tokenneedstobelongenoughelseitwontworkg",
127127
Prerequisites: []etcddata.Prerequisite{
128128
{
129129
GvrData: gvr("oauth.openshift.io", "v1", "oauthclients"),
130-
Stub: `{"metadata": {"name": "client0g"}}`,
130+
Stub: `{"metadata": {"name": "client0g"}, "grantMethod": "auto"}`,
131131
},
132132
},
133133
},
134134
gvr("oauth.openshift.io", "v1", "oauthclients"): {
135-
Stub: `{"metadata": {"name": "clientg"}}`,
135+
Stub: `{"metadata": {"name": "clientg"}, "grantMethod": "prompt"}`,
136136
ExpectedEtcdPath: "openshift.io/oauth/clients/clientg",
137137
},
138138
// --

‎test/integration/oauth_serviceaccount_client_test.go‎

Lines changed: 1 addition & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -160,26 +160,8 @@ func TestOAuthServiceAccountClient(t *testing.T) {
160160
t.Fatalf("Unexpected error: %v", err)
161161
} else if !reflect.DeepEqual(clientAuth.Scopes, []string{"user:full"}) {
162162
t.Fatalf("Unexpected scopes: %v", clientAuth.Scopes)
163-
} else {
164-
// update the authorization to not contain any approved scopes
165-
clientAuth.Scopes = nil
166-
if _, err := clusterAdminOAuthClient.OAuthClientAuthorizations().Update(clientAuth); err != nil {
167-
t.Fatalf("Unexpected error: %v", err)
168-
}
169163
}
170-
// approval steps are needed again for unscoped access
171-
runOAuthFlow(t, clusterAdminClientConfig, projectName, oauthClientConfig, nil, authorizationCodes, authorizationErrors, true, true, []string{
172-
"GET /oauth/authorize",
173-
"received challenge",
174-
"GET /oauth/authorize",
175-
"redirect to /oauth/authorize/approve",
176-
"form",
177-
"POST /oauth/authorize/approve",
178-
"redirect to /oauth/authorize",
179-
"redirect to /oauthcallback",
180-
"code",
181-
"scope:user:full",
182-
})
164+
183165
// with the authorization stored, approval steps are skipped
184166
runOAuthFlow(t, clusterAdminClientConfig, projectName, oauthClientConfig, nil, authorizationCodes, authorizationErrors, true, true, []string{
185167
"GET /oauth/authorize",

‎test/integration/oauthstorage_test.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,7 @@ func TestOAuthStorage(t *testing.T) {
9494
oaclientConfig := &osincli.ClientConfig{
9595
ClientId: testClient,
9696
ClientSecret: testClientSecret0,
97+
Scope: "user:full",
9798
RedirectUrl: assertServer.URL + testClientRedirect,
9899
AuthorizeUrl: server.URL + authorizePath,
99100
TokenUrl: server.URL + tokenPath,
@@ -112,6 +113,7 @@ func TestOAuthStorage(t *testing.T) {
112113
ObjectMeta: metav1.ObjectMeta{Name: testClient},
113114
Secret: testClientSecret0,
114115
AdditionalSecrets: []string{testClientSecret1},
116+
GrantMethod: oauthapi.GrantHandlerAuto,
115117
RedirectURIs: []string{assertServer.URL + testClientRedirect},
116118
}); err != nil {
117119
t.Fatal(err)

‎test/integration/scopes_test.go‎

Lines changed: 72 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -66,12 +66,13 @@ func TestScopedTokens(t *testing.T) {
6666
}
6767

6868
whoamiOnlyToken := &oauthapi.OAuthAccessToken{
69-
ObjectMeta: metav1.ObjectMeta{Name: "whoami-token-plus-some-padding-here-to-make-the-limit"},
70-
ClientName: "openshift-challenging-client",
71-
ExpiresIn: 200,
72-
Scopes: []string{scope.UserInfo},
73-
UserName: userName,
74-
UserUID: string(haroldUser.UID),
69+
ObjectMeta: metav1.ObjectMeta{Name: "whoami-token-plus-some-padding-here-to-make-the-limit"},
70+
ClientName: "openshift-challenging-client",
71+
ExpiresIn: 200,
72+
Scopes: []string{scope.UserInfo},
73+
UserName: userName,
74+
UserUID: string(haroldUser.UID),
75+
RedirectURI: "https://localhost:8443/oauth/token/implicit",
7576
}
7677
if _, err := oauthclient.NewForConfigOrDie(clusterAdminClientConfig).OAuthAccessTokens().Create(whoamiOnlyToken); err != nil {
7778
t.Fatalf("unexpected error: %v", err)
@@ -170,12 +171,13 @@ func TestScopeEscalations(t *testing.T) {
170171
}
171172

172173
nonEscalatingEditToken := &oauthapi.OAuthAccessToken{
173-
ObjectMeta: metav1.ObjectMeta{Name: "non-escalating-edit-plus-some-padding-here-to-make-the-limit"},
174-
ClientName: "openshift-challenging-client",
175-
ExpiresIn: 200,
176-
Scopes: []string{scope.ClusterRoleIndicator + "edit:*"},
177-
UserName: userName,
178-
UserUID: string(haroldUser.UID),
174+
ObjectMeta: metav1.ObjectMeta{Name: "non-escalating-edit-plus-some-padding-here-to-make-the-limit"},
175+
ClientName: "openshift-challenging-client",
176+
ExpiresIn: 200,
177+
Scopes: []string{scope.ClusterRoleIndicator + "edit:*"},
178+
UserName: userName,
179+
UserUID: string(haroldUser.UID),
180+
RedirectURI: "https://localhost:8443/oauth/token/implicit",
179181
}
180182
if _, err := clusterAdminOAuthClient.OAuthAccessTokens().Create(nonEscalatingEditToken); err != nil {
181183
t.Fatalf("unexpected error: %v", err)
@@ -193,12 +195,13 @@ func TestScopeEscalations(t *testing.T) {
193195
}
194196

195197
escalatingEditToken := &oauthapi.OAuthAccessToken{
196-
ObjectMeta: metav1.ObjectMeta{Name: "escalating-edit-plus-some-padding-here-to-make-the-limit"},
197-
ClientName: "openshift-challenging-client",
198-
ExpiresIn: 200,
199-
Scopes: []string{scope.ClusterRoleIndicator + "edit:*:!"},
200-
UserName: userName,
201-
UserUID: string(haroldUser.UID),
198+
ObjectMeta: metav1.ObjectMeta{Name: "escalating-edit-plus-some-padding-here-to-make-the-limit"},
199+
ClientName: "openshift-challenging-client",
200+
ExpiresIn: 200,
201+
Scopes: []string{scope.ClusterRoleIndicator + "edit:*:!"},
202+
UserName: userName,
203+
UserUID: string(haroldUser.UID),
204+
RedirectURI: "https://localhost:8443/oauth/token/implicit",
202205
}
203206
if _, err := clusterAdminOAuthClient.OAuthAccessTokens().Create(escalatingEditToken); err != nil {
204207
t.Fatalf("unexpected error: %v", err)
@@ -241,6 +244,7 @@ func TestTokensWithIllegalScopes(t *testing.T) {
241244
},
242245
},
243246
},
247+
GrantMethod: oauthapi.GrantHandlerAuto,
244248
}
245249
if _, err := clusterAdminOAuthClient.OAuthClients().Create(client); err != nil {
246250
t.Fatalf("unexpected error: %v", err)
@@ -314,42 +318,46 @@ func TestTokensWithIllegalScopes(t *testing.T) {
314318
name: "no scopes",
315319
fail: true,
316320
obj: &oauthapi.OAuthAccessToken{
317-
ObjectMeta: metav1.ObjectMeta{Name: "tokenlongenoughtobecreatedwithoutfailing"},
318-
ClientName: client.Name,
319-
UserName: "name",
320-
UserUID: "uid",
321+
ObjectMeta: metav1.ObjectMeta{Name: "tokenlongenoughtobecreatedwithoutfailing"},
322+
ClientName: client.Name,
323+
UserName: "name",
324+
UserUID: "uid",
325+
RedirectURI: "https://localhost:8443/oauth/token/implicit",
321326
},
322327
},
323328
{
324329
name: "denied literal",
325330
fail: true,
326331
obj: &oauthapi.OAuthAccessToken{
327-
ObjectMeta: metav1.ObjectMeta{Name: "tokenlongenoughtobecreatedwithoutfailing"},
328-
ClientName: client.Name,
329-
UserName: "name",
330-
UserUID: "uid",
331-
Scopes: []string{"user:info", "user:check-access"},
332+
ObjectMeta: metav1.ObjectMeta{Name: "tokenlongenoughtobecreatedwithoutfailing"},
333+
ClientName: client.Name,
334+
UserName: "name",
335+
UserUID: "uid",
336+
Scopes: []string{"user:info", "user:check-access"},
337+
RedirectURI: "https://localhost:8443/oauth/token/implicit",
332338
},
333339
},
334340
{
335341
name: "denied role",
336342
fail: true,
337343
obj: &oauthapi.OAuthAccessToken{
338-
ObjectMeta: metav1.ObjectMeta{Name: "tokenlongenoughtobecreatedwithoutfailing"},
339-
ClientName: client.Name,
340-
UserName: "name",
341-
UserUID: "uid",
342-
Scopes: []string{"role:one:*"},
344+
ObjectMeta: metav1.ObjectMeta{Name: "tokenlongenoughtobecreatedwithoutfailing"},
345+
ClientName: client.Name,
346+
UserName: "name",
347+
UserUID: "uid",
348+
Scopes: []string{"role:one:*"},
349+
RedirectURI: "https://localhost:8443/oauth/token/implicit",
343350
},
344351
},
345352
{
346353
name: "ok role",
347354
obj: &oauthapi.OAuthAccessToken{
348-
ObjectMeta: metav1.ObjectMeta{Name: "tokenlongenoughtobecreatedwithoutfailing"},
349-
ClientName: client.Name,
350-
UserName: "name",
351-
UserUID: "uid",
352-
Scopes: []string{"role:one:bravo"},
355+
ObjectMeta: metav1.ObjectMeta{Name: "tokenlongenoughtobecreatedwithoutfailing"},
356+
ClientName: client.Name,
357+
UserName: "name",
358+
UserUID: "uid",
359+
Scopes: []string{"role:one:bravo"},
360+
RedirectURI: "https://localhost:8443/oauth/token/implicit",
353361
},
354362
},
355363
}
@@ -373,46 +381,50 @@ func TestTokensWithIllegalScopes(t *testing.T) {
373381
name: "no scopes",
374382
fail: true,
375383
obj: &oauthapi.OAuthAuthorizeToken{
376-
ObjectMeta: metav1.ObjectMeta{Name: "tokenlongenoughtobecreatedwithoutfailing"},
377-
ClientName: client.Name,
378-
ExpiresIn: 86400,
379-
UserName: "name",
380-
UserUID: "uid",
384+
ObjectMeta: metav1.ObjectMeta{Name: "tokenlongenoughtobecreatedwithoutfailing"},
385+
ClientName: client.Name,
386+
ExpiresIn: 86400,
387+
UserName: "name",
388+
UserUID: "uid",
389+
RedirectURI: "https://localhost:8443/oauth/token/implicit",
381390
},
382391
},
383392
{
384393
name: "denied literal",
385394
fail: true,
386395
obj: &oauthapi.OAuthAuthorizeToken{
387-
ObjectMeta: metav1.ObjectMeta{Name: "tokenlongenoughtobecreatedwithoutfailing"},
388-
ClientName: client.Name,
389-
ExpiresIn: 86400,
390-
UserName: "name",
391-
UserUID: "uid",
392-
Scopes: []string{"user:info", "user:check-access"},
396+
ObjectMeta: metav1.ObjectMeta{Name: "tokenlongenoughtobecreatedwithoutfailing"},
397+
ClientName: client.Name,
398+
ExpiresIn: 86400,
399+
UserName: "name",
400+
UserUID: "uid",
401+
Scopes: []string{"user:info", "user:check-access"},
402+
RedirectURI: "https://localhost:8443/oauth/token/implicit",
393403
},
394404
},
395405
{
396406
name: "denied role",
397407
fail: true,
398408
obj: &oauthapi.OAuthAuthorizeToken{
399-
ObjectMeta: metav1.ObjectMeta{Name: "tokenlongenoughtobecreatedwithoutfailing"},
400-
ClientName: client.Name,
401-
ExpiresIn: 86400,
402-
UserName: "name",
403-
UserUID: "uid",
404-
Scopes: []string{"role:one:*"},
409+
ObjectMeta: metav1.ObjectMeta{Name: "tokenlongenoughtobecreatedwithoutfailing"},
410+
ClientName: client.Name,
411+
ExpiresIn: 86400,
412+
UserName: "name",
413+
UserUID: "uid",
414+
Scopes: []string{"role:one:*"},
415+
RedirectURI: "https://localhost:8443/oauth/token/implicit",
405416
},
406417
},
407418
{
408419
name: "ok role",
409420
obj: &oauthapi.OAuthAuthorizeToken{
410-
ObjectMeta: metav1.ObjectMeta{Name: "tokenlongenoughtobecreatedwithoutfailing"},
411-
ClientName: client.Name,
412-
ExpiresIn: 86400,
413-
UserName: "name",
414-
UserUID: "uid",
415-
Scopes: []string{"role:one:bravo"},
421+
ObjectMeta: metav1.ObjectMeta{Name: "tokenlongenoughtobecreatedwithoutfailing"},
422+
ClientName: client.Name,
423+
ExpiresIn: 86400,
424+
UserName: "name",
425+
UserUID: "uid",
426+
Scopes: []string{"role:one:bravo"},
427+
RedirectURI: "https://localhost:8443/oauth/token/implicit",
416428
},
417429
},
418430
}

‎test/testdata/oauthaccesstoken.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,6 @@ metadata:
66
name: DYGZDLucARCPIfUeKPhsgPfn0WBLR_9KdeREH0c9iod
77
redirectURI: https://localhost:8443/oauth/token/implicit
88
userName: test
9-
userUID: 322b236b-22b9-11e6-b307-080027242396
9+
userUID: 322b236b-22b9-11e6-b307-080027242396
10+
scopes:
11+
- user:info

‎test/util/client.go‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,8 @@ func GetClientForUser(clusterAdminConfig *restclient.Config, username string) (k
9797
}
9898

9999
oauthClientObj := &oauthapi.OAuthClient{
100-
ObjectMeta: metav1.ObjectMeta{Name: "test-integration-client"},
100+
ObjectMeta: metav1.ObjectMeta{Name: "test-integration-client"},
101+
GrantMethod: oauthapi.GrantHandlerAuto,
101102
}
102103
if _, err := oauthClient.Oauth().OAuthClients().Create(oauthClientObj); err != nil && !kerrs.IsAlreadyExists(err) {
103104
return nil, nil, err
@@ -110,10 +111,12 @@ func GetClientForUser(clusterAdminConfig *restclient.Config, username string) (k
110111
accesstoken += "A"
111112
}
112113
token := &oauthapi.OAuthAccessToken{
113-
ObjectMeta: metav1.ObjectMeta{Name: accesstoken},
114-
ClientName: oauthClientObj.Name,
115-
UserName: username,
116-
UserUID: string(user.UID),
114+
ObjectMeta: metav1.ObjectMeta{Name: accesstoken},
115+
ClientName: oauthClientObj.Name,
116+
UserName: username,
117+
UserUID: string(user.UID),
118+
Scopes: []string{"user:full"},
119+
RedirectURI: "https://localhost:8443/oauth/token/implicit",
117120
}
118121
if _, err := oauthClient.Oauth().OAuthAccessTokens().Create(token); err != nil {
119122
return nil, nil, err

0 commit comments

Comments
 (0)