3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-05-09 23:27:43 +02:00
Code Issues Projects Releases Packages Wiki Activity

envoy: implement refresh session (#674)

Browse source 
* authorize: refresh session WIP

* remove upstream cookie with lua

* only refresh session on expired

* authorize: handle session expiration

* authorize: add refresh test, fix isExpired check

* proxy: implement preserve host header option

* authorize: allow CORS preflight requests

* proxy: add request headers

* authenticate: use id token expiry
This commit is contained in:
Caleb Doxsey 2020-05-11 07:29:23 -06:00 • committed by Travis Groth
parent ae3049baca
commit 0d9a372182
7 changed files with 284 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

61
integration/authorization_test.go
View file

@ -7,8 +7,9 @@ import (
"testing"
"time"
"github.com/pomerium/pomerium/integration/internal/flows"
"github.com/stretchr/testify/assert"
"github.com/pomerium/pomerium/integration/internal/flows"
)
func TestAuthorization(t *testing.T) {
@ -34,14 +35,16 @@ func TestAuthorization(t *testing.T) {
t.Run("domains", func(t *testing.T) {
t.Run("allowed", func(t *testing.T) {
client := testcluster.NewHTTPClient()
res, err := flows.Authenticate(ctx, client, mustParseURL("https://httpdetails.localhost.pomerium.io/by-domain"), "bob@dogs.test", []string{"user"})
res, err := flows.Authenticate(ctx, client, mustParseURL("https://httpdetails.localhost.pomerium.io/by-domain"),
flows.WithEmail("bob@dogs.test"), flows.WithGroups("user"))
if assert.NoError(t, err) {
assert.Equal(t, http.StatusOK, res.StatusCode, "expected OK for dogs.test")
}
})
t.Run("not allowed", func(t *testing.T) {
client := testcluster.NewHTTPClient()
res, err := flows.Authenticate(ctx, client, mustParseURL("https://httpdetails.localhost.pomerium.io/by-domain"), "joe@cats.test", []string{"user"})
res, err := flows.Authenticate(ctx, client, mustParseURL("https://httpdetails.localhost.pomerium.io/by-domain"),
flows.WithEmail("joe@cats.test"), flows.WithGroups("user"))
if assert.NoError(t, err) {
assertDeniedAccess(t, res, "expected Forbidden for cats.test")
}
@ -50,14 +53,16 @@ func TestAuthorization(t *testing.T) {
t.Run("users", func(t *testing.T) {
t.Run("allowed", func(t *testing.T) {
client := testcluster.NewHTTPClient()
res, err := flows.Authenticate(ctx, client, mustParseURL("https://httpdetails.localhost.pomerium.io/by-user"), "bob@dogs.test", []string{"user"})
res, err := flows.Authenticate(ctx, client, mustParseURL("https://httpdetails.localhost.pomerium.io/by-user"),
flows.WithEmail("bob@dogs.test"), flows.WithGroups("user"))
if assert.NoError(t, err) {
assert.Equal(t, http.StatusOK, res.StatusCode, "expected OK for bob@dogs.test")
}
})
t.Run("not allowed", func(t *testing.T) {
client := testcluster.NewHTTPClient()
res, err := flows.Authenticate(ctx, client, mustParseURL("https://httpdetails.localhost.pomerium.io/by-user"), "joe@cats.test", []string{"user"})
res, err := flows.Authenticate(ctx, client, mustParseURL("https://httpdetails.localhost.pomerium.io/by-user"),
flows.WithEmail("joe@cats.test"), flows.WithGroups("user"))
if assert.NoError(t, err) {
assertDeniedAccess(t, res, "expected Forbidden for joe@cats.test")
}
@ -66,19 +71,61 @@ func TestAuthorization(t *testing.T) {
t.Run("groups", func(t *testing.T) {
t.Run("allowed", func(t *testing.T) {
client := testcluster.NewHTTPClient()
res, err := flows.Authenticate(ctx, client, mustParseURL("https://httpdetails.localhost.pomerium.io/by-group"), "bob@dogs.test", []string{"admin", "user"})
res, err := flows.Authenticate(ctx, client, mustParseURL("https://httpdetails.localhost.pomerium.io/by-group"),
flows.WithEmail("bob@dogs.test"), flows.WithGroups("admin", "user"))
if assert.NoError(t, err) {
assert.Equal(t, http.StatusOK, res.StatusCode, "expected OK for admin")
}
})
t.Run("not allowed", func(t *testing.T) {
client := testcluster.NewHTTPClient()
res, err := flows.Authenticate(ctx, client, mustParseURL("https://httpdetails.localhost.pomerium.io/by-group"), "joe@cats.test", []string{"user"})
res, err := flows.Authenticate(ctx, client, mustParseURL("https://httpdetails.localhost.pomerium.io/by-group"),
flows.WithEmail("joe@cats.test"), flows.WithGroups("user"))
if assert.NoError(t, err) {
assertDeniedAccess(t, res, "expected Forbidden for user, but got %d", res.StatusCode)
}
})
})
t.Run("refresh", func(t *testing.T) {
client := testcluster.NewHTTPClient()
res, err := flows.Authenticate(ctx, client, mustParseURL("https://httpdetails.localhost.pomerium.io/by-domain"),
flows.WithEmail("bob@dogs.test"), flows.WithGroups("user"), flows.WithTokenExpiration(time.Second))
if !assert.NoError(t, err) {
return
}
assert.Equal(t, http.StatusOK, res.StatusCode, "expected OK for dogs.test")
res.Body.Close()
// poll till we get a new cookie because of a refreshed session
ticker := time.NewTicker(time.Millisecond * 500)
defer ticker.Stop()
deadline := time.NewTimer(time.Second * 10)
defer deadline.Stop()
for i := 0; ; i++ {
select {
case <-ticker.C:
case <-deadline.C:
t.Fatal("timed out waiting for refreshed session")
return
case <-ctx.Done():
t.Fatal("timed out waiting for refreshed session")
return
}
res, err = client.Get(mustParseURL("https://httpdetails.localhost.pomerium.io/by-domain").String())
if !assert.NoError(t, err) {
return
}
res.Body.Close()
if !assert.Equal(t, http.StatusOK, res.StatusCode, "failed after %d times", i+1) {
return
}
if res.Header.Get("Set-Cookie") != "" {
break
}
}
})
}
func mustParseURL(str string) *url.URL {