diff --git a/authorize/check_response.go b/authorize/check_response.go index bed8f9b4a..4bbaf5c27 100644 --- a/authorize/check_response.go +++ b/authorize/check_response.go @@ -37,7 +37,7 @@ func (a *Authorize) okResponse(reply *evaluator.Result) *envoy_service_auth_v2.C } return &envoy_service_auth_v2.CheckResponse{ - Status: &status.Status{Code: int32(codes.OK), Message: "OK"}, + Status: &status.Status{Code: int32(codes.OK), Message: reply.Message}, HttpResponse: &envoy_service_auth_v2.CheckResponse_OkResponse{ OkResponse: &envoy_service_auth_v2.OkHttpResponse{ Headers: requestHeaders, diff --git a/authorize/check_response_test.go b/authorize/check_response_test.go new file mode 100644 index 000000000..3f005283b --- /dev/null +++ b/authorize/check_response_test.go @@ -0,0 +1,152 @@ +package authorize + +import ( + "net/http" + "net/http/httptest" + "net/url" + "testing" + "time" + + envoy_api_v2_core "github.com/envoyproxy/go-control-plane/envoy/api/v2/core" + envoy_service_auth_v2 "github.com/envoyproxy/go-control-plane/envoy/service/auth/v2" + "github.com/stretchr/testify/assert" + "google.golang.org/genproto/googleapis/rpc/status" + + "github.com/pomerium/pomerium/authorize/evaluator" + "github.com/pomerium/pomerium/config" + "github.com/pomerium/pomerium/internal/encoding/jws" +) + +func TestAuthorize_okResponse(t *testing.T) { + a := new(Authorize) + encoder, _ := jws.NewHS256Signer([]byte{0, 0, 0, 0}, "") + a.currentEncoder.Store(encoder) + a.currentOptions.Store(&config.Options{ + Policies: []config.Policy{{ + Source: &config.StringURL{URL: &url.URL{Host: "example.com"}}, + SubPolicies: []config.SubPolicy{{ + Rego: []string{"allow = true"}, + }}, + }}, + }) + + originalGCPIdentityDocURL := gcpIdentityDocURL + defer func() { + gcpIdentityDocURL = originalGCPIdentityDocURL + gcpIdentityNow = time.Now + }() + + now := time.Date(2020, 1, 1, 1, 0, 0, 0, time.UTC) + gcpIdentityNow = func() time.Time { + return now + } + + srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + _, _ = w.Write([]byte(now.Format(time.RFC3339))) + })) + defer srv.Close() + gcpIdentityDocURL = srv.URL + + tests := []struct { + name string + reply *evaluator.Result + want *envoy_service_auth_v2.CheckResponse + }{ + { + "ok reply", + &evaluator.Result{Status: 0, Message: "ok", SignedJWT: "valid-signed-jwt"}, + &envoy_service_auth_v2.CheckResponse{ + Status: &status.Status{Code: 0, Message: "ok"}, + HttpResponse: &envoy_service_auth_v2.CheckResponse_OkResponse{ + OkResponse: &envoy_service_auth_v2.OkHttpResponse{ + Headers: []*envoy_api_v2_core.HeaderValueOption{ + mkHeader("x-pomerium-jwt-assertion", "valid-signed-jwt", false), + }, + }, + }, + }, + }, + { + "ok reply with k8s svc", + &evaluator.Result{ + Status: 0, + Message: "ok", + SignedJWT: "valid-signed-jwt", + MatchingPolicy: &config.Policy{ + KubernetesServiceAccountToken: "k8s-svc-account", + }, + }, + &envoy_service_auth_v2.CheckResponse{ + Status: &status.Status{Code: 0, Message: "ok"}, + HttpResponse: &envoy_service_auth_v2.CheckResponse_OkResponse{ + OkResponse: &envoy_service_auth_v2.OkHttpResponse{ + Headers: []*envoy_api_v2_core.HeaderValueOption{ + mkHeader("x-pomerium-jwt-assertion", "valid-signed-jwt", false), + mkHeader("Authorization", "Bearer k8s-svc-account", false), + }, + }, + }, + }, + }, + { + "ok reply with k8s svc impersonate", + &evaluator.Result{ + Status: 0, + Message: "ok", + SignedJWT: "valid-signed-jwt", + MatchingPolicy: &config.Policy{ + KubernetesServiceAccountToken: "k8s-svc-account", + }, + UserEmail: "foo@example.com", + UserGroups: []string{"admin", "test"}, + }, + &envoy_service_auth_v2.CheckResponse{ + Status: &status.Status{Code: 0, Message: "ok"}, + HttpResponse: &envoy_service_auth_v2.CheckResponse_OkResponse{ + OkResponse: &envoy_service_auth_v2.OkHttpResponse{ + Headers: []*envoy_api_v2_core.HeaderValueOption{ + mkHeader("x-pomerium-jwt-assertion", "valid-signed-jwt", false), + mkHeader("Authorization", "Bearer k8s-svc-account", false), + mkHeader("Impersonate-User", "foo@example.com", false), + mkHeader("Impersonate-Group", "admin", true), + mkHeader("Impersonate-Group", "test", true), + }, + }, + }, + }, + }, + { + "ok reply with google cloud serverless", + &evaluator.Result{ + Status: 0, + Message: "ok", + SignedJWT: "valid-signed-jwt", + MatchingPolicy: &config.Policy{ + EnableGoogleCloudServerlessAuthentication: true, + Destination: mustParseURL("https://example.com"), + }, + }, + &envoy_service_auth_v2.CheckResponse{ + Status: &status.Status{Code: 0, Message: "ok"}, + HttpResponse: &envoy_service_auth_v2.CheckResponse_OkResponse{ + OkResponse: &envoy_service_auth_v2.OkHttpResponse{ + Headers: []*envoy_api_v2_core.HeaderValueOption{ + mkHeader("x-pomerium-jwt-assertion", "valid-signed-jwt", false), + mkHeader("Authorization", "Bearer 2020-01-01T01:00:00Z", false), + }, + }, + }, + }, + }, + } + + for _, tc := range tests { + tc := tc + t.Run(tc.name, func(t *testing.T) { + got := a.okResponse(tc.reply) + assert.Equal(t, tc.want.Status.Code, got.Status.Code) + assert.Equal(t, tc.want.Status.Message, got.Status.Message) + assert.Equal(t, tc.want.GetOkResponse().GetHeaders(), got.GetOkResponse().GetHeaders()) + }) + } +} diff --git a/go.sum b/go.sum index 1614f3b80..4a845affc 100644 --- a/go.sum +++ b/go.sum @@ -23,8 +23,6 @@ cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIA cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw= cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos= cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk= -contrib.go.opencensus.io/exporter/jaeger v0.2.0 h1:nhTv/Ry3lGmqbJ/JGvCjWxBl5ozRfqo86Ngz59UAlfk= -contrib.go.opencensus.io/exporter/jaeger v0.2.0/go.mod h1:ukdzwIYYHgZ7QYtwVFQUjiT28BJHiMhTERo32s6qVgM= contrib.go.opencensus.io/exporter/jaeger v0.2.1 h1:yGBYzYMewVL0yO9qqJv3Z5+IRhPdU7e9o/2oKpX4YvI= contrib.go.opencensus.io/exporter/jaeger v0.2.1/go.mod h1:Y8IsLgdxqh1QxYxPC5IgXVmBaeLUeQFfBeBi9PbeZd0= contrib.go.opencensus.io/exporter/ocagent v0.4.12/go.mod h1:450APlNTSR6FrvC3CTRqYosuDstRB9un7SOx2k/9ckA= @@ -208,6 +206,7 @@ github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw= github.com/golang/mock v1.4.3 h1:GV+pQPG/EUUbkh47niozDcADz6go/dUwhVzdUQHIVRw= github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw= +github.com/golang/mock v1.4.4 h1:l75CXGRSwbaYNpl/Z2X1XIIAMSCquvXgpVZDhwEIJsc= github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4= github.com/golang/protobuf v0.0.0-20181025225059-d3de96c4c28e/go.mod h1:Qd/q+1AKNOZr9uGQzbzCmRO6sUih6GTPZv6a1/R87v0= github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= @@ -537,8 +536,7 @@ github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnIn github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA= github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/spf13/viper v1.4.0/go.mod h1:PTJ7Z/lr49W6bUbkmS1V3by4uWynFiR9p7+dSq/yZzE= -github.com/spf13/viper v1.7.0 h1:xVKxvI7ouOI5I+U9s2eeiUfMaWBVoXA3AWskkrqK0VM= -github.com/spf13/viper v1.7.0/go.mod h1:8WkrPz2fc9jxqZNCJI/76HCieCp4Q8HaLFoCha5qpdg= +github.com/spf13/viper v1.7.1 h1:pM5oEahlgWv/WnHXpgbKz7iLIxRf65tye2Ci+XFK5sk= github.com/spf13/viper v1.7.1/go.mod h1:8WkrPz2fc9jxqZNCJI/76HCieCp4Q8HaLFoCha5qpdg= github.com/streadway/amqp v0.0.0-20190404075320-75d898a42a94/go.mod h1:AZpEONHx3DKn8O/DFsRAY58/XVQiIPMTMB1SddzLXVw= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= @@ -557,9 +555,7 @@ github.com/tomnomnom/linkheader v0.0.0-20180905144013-02ca5825eb80 h1:nrZ3ySNYwJ github.com/tomnomnom/linkheader v0.0.0-20180905144013-02ca5825eb80/go.mod h1:iFyPdL66DjUD96XmzVL3ZntbzcflLnznH0fr99w5VqE= github.com/transip/gotransip/v6 v6.0.2/go.mod h1:pQZ36hWWRahCUXkFWlx9Hs711gLd8J4qdgLdRzmtY+g= github.com/uber-go/atomic v1.3.2/go.mod h1:/Ct5t2lcmbJ4OSe/waGBoaVvVqtO0bmtfVNex1PFV8g= -github.com/uber/jaeger-client-go v2.15.0+incompatible/go.mod h1:WVhlPFC8FDjOFMMWRy2pZqQJSXxYSwNYOkTr/Z6d3Kk= -github.com/uber/jaeger-client-go v2.20.1+incompatible h1:HgqpYBng0n7tLJIlyT4kPCIv5XgCsF+kai1NnnrJzEU= -github.com/uber/jaeger-client-go v2.20.1+incompatible/go.mod h1:WVhlPFC8FDjOFMMWRy2pZqQJSXxYSwNYOkTr/Z6d3Kk= +github.com/uber/jaeger-client-go v2.25.0+incompatible h1:IxcNZ7WRY1Y3G4poYlx24szfsn/3LvK9QHCq9oQw8+U= github.com/uber/jaeger-client-go v2.25.0+incompatible/go.mod h1:WVhlPFC8FDjOFMMWRy2pZqQJSXxYSwNYOkTr/Z6d3Kk= github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc= github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0= @@ -596,15 +592,13 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk golang.org/x/crypto v0.0.0-20190418165655-df01cb2cc480/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE= golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= -golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392/go.mod h1:/lpIB1dKB+9EgE3H3cr1v9wB50oz8l4C4h62xy7jSTY= golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200115085410-6d4e4cb37c7d/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 h1:psW17arqaxU48Z5kZ0CQnkZWQJsqcURM6tKiBApRjXI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= -golang.org/x/crypto v0.0.0-20200709230013-948cd5f35899 h1:DZhuSZLsGlFL4CmhA8BcRA0mnthyA/nZ00AqCUo7vHg= -golang.org/x/crypto v0.0.0-20200709230013-948cd5f35899/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= +golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de h1:ikNHVSjEfnvz6sxdSPCaPt572qowuyMDMJLLm3Db3ig= golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=