mirror of
https://github.com/zitadel/zitadel.git
synced 2024-12-24 08:41:33 +00:00
8054e6753a
* fix(oidc): roles in userinfo for client credentials token When tokens were obtained using the client credentials grant, with audience and role scopes, userinfo would not return the role claims. This had multiple causes: 1. There is no auth request flow, so for legacy userinfo project data was never attached to the token 2. For optimized userinfo, there is no client ID that maps to an application. The client ID for client credentials is the machine user's name. There we can't obtain a project ID. When the project ID remained empty, we always ignored the roleAudience. This PR fixes situation 2, by always taking the roleAudience into account, even when the projectID is empty. The code responsible for the bug is also refactored to be more readable and understandable, including additional godoc. The fix only applies to the optimized userinfo code introduced in #7706 and released in v2.50 (currently in RC). Therefore it can't be back-ported to earlier versions. Fixes #6662 * chore(deps): update all go deps (#7764) This change updates all go modules, including oidc, a major version of go-jose and the go 1.22 release. * Revert "chore(deps): update all go deps" (#7772) Revert "chore(deps): update all go deps (#7764)" This reverts commit 6893e7d060a953d595a18ff8daa979834c4324d5. --------- Co-authored-by: Livio Spring <livio.a@gmail.com> (cherry picked from commit 9ccbbe05bc602d57e1eb897d4d28e876ff7dea86)
522 lines
13 KiB
Go
522 lines
13 KiB
Go
package oidc
|
|
|
|
import (
|
|
"context"
|
|
"encoding/base64"
|
|
"fmt"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/zitadel/oidc/v3/pkg/oidc"
|
|
"golang.org/x/text/language"
|
|
|
|
"github.com/zitadel/zitadel/internal/domain"
|
|
"github.com/zitadel/zitadel/internal/query"
|
|
)
|
|
|
|
func Test_prepareRoles(t *testing.T) {
|
|
type args struct {
|
|
projectID string
|
|
scope []string
|
|
projectRoleAssertion bool
|
|
currentProjectOnly bool
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
args args
|
|
wantRoleAudience []string
|
|
wantRequestedRoles []string
|
|
}{
|
|
{
|
|
name: "empty scope",
|
|
args: args{
|
|
projectID: "projID",
|
|
scope: nil,
|
|
projectRoleAssertion: false,
|
|
currentProjectOnly: false,
|
|
},
|
|
wantRoleAudience: nil,
|
|
wantRequestedRoles: nil,
|
|
},
|
|
{
|
|
name: "project role assertion",
|
|
args: args{
|
|
projectID: "projID",
|
|
projectRoleAssertion: true,
|
|
scope: nil,
|
|
currentProjectOnly: false,
|
|
},
|
|
wantRoleAudience: []string{"projID"},
|
|
wantRequestedRoles: nil,
|
|
},
|
|
{
|
|
name: "some scope, current project only",
|
|
args: args{
|
|
projectID: "projID",
|
|
projectRoleAssertion: false,
|
|
scope: []string{"openid", "profile"},
|
|
currentProjectOnly: true,
|
|
},
|
|
wantRoleAudience: []string{"projID"},
|
|
wantRequestedRoles: nil,
|
|
},
|
|
{
|
|
name: "scope projects roles",
|
|
args: args{
|
|
projectID: "projID",
|
|
projectRoleAssertion: false,
|
|
scope: []string{
|
|
"openid", "profile",
|
|
ScopeProjectsRoles,
|
|
domain.ProjectIDScope + "project2" + domain.AudSuffix,
|
|
},
|
|
currentProjectOnly: false,
|
|
},
|
|
wantRoleAudience: []string{"project2", "projID"},
|
|
wantRequestedRoles: nil,
|
|
},
|
|
{
|
|
name: "scope projects roles ignored, current project only",
|
|
args: args{
|
|
projectID: "projID",
|
|
projectRoleAssertion: false,
|
|
scope: []string{
|
|
"openid", "profile",
|
|
ScopeProjectsRoles,
|
|
domain.ProjectIDScope + "project2" + domain.AudSuffix,
|
|
},
|
|
currentProjectOnly: true,
|
|
},
|
|
wantRoleAudience: []string{"projID"},
|
|
wantRequestedRoles: nil,
|
|
},
|
|
{
|
|
name: "scope project role prefix",
|
|
args: args{
|
|
projectID: "projID",
|
|
projectRoleAssertion: false,
|
|
scope: []string{
|
|
"openid", "profile",
|
|
ScopeProjectRolePrefix + "foo",
|
|
ScopeProjectRolePrefix + "bar",
|
|
},
|
|
currentProjectOnly: false,
|
|
},
|
|
wantRoleAudience: []string{"projID"},
|
|
wantRequestedRoles: []string{"foo", "bar"},
|
|
},
|
|
{
|
|
name: "scope project role prefix and audience",
|
|
args: args{
|
|
projectID: "projID",
|
|
projectRoleAssertion: false,
|
|
scope: []string{
|
|
"openid", "profile",
|
|
ScopeProjectRolePrefix + "foo",
|
|
ScopeProjectRolePrefix + "bar",
|
|
domain.ProjectIDScope + "project2" + domain.AudSuffix,
|
|
},
|
|
currentProjectOnly: false,
|
|
},
|
|
wantRoleAudience: []string{"projID", "project2"},
|
|
wantRequestedRoles: []string{"foo", "bar"},
|
|
},
|
|
{
|
|
name: "scope project role prefix and audience ignored, current project only",
|
|
args: args{
|
|
projectID: "projID",
|
|
projectRoleAssertion: false,
|
|
scope: []string{
|
|
"openid", "profile",
|
|
ScopeProjectRolePrefix + "foo",
|
|
ScopeProjectRolePrefix + "bar",
|
|
domain.ProjectIDScope + "project2" + domain.AudSuffix,
|
|
},
|
|
currentProjectOnly: true,
|
|
},
|
|
wantRoleAudience: []string{"projID"},
|
|
wantRequestedRoles: []string{"foo", "bar"},
|
|
},
|
|
{
|
|
name: "no projectID, scope project role prefix and audience",
|
|
args: args{
|
|
projectID: "",
|
|
projectRoleAssertion: false,
|
|
scope: []string{
|
|
"openid", "profile",
|
|
ScopeProjectRolePrefix + "foo",
|
|
ScopeProjectRolePrefix + "bar",
|
|
domain.ProjectIDScope + "project2" + domain.AudSuffix,
|
|
},
|
|
currentProjectOnly: false,
|
|
},
|
|
wantRoleAudience: []string{"project2"},
|
|
wantRequestedRoles: []string{"foo", "bar"},
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
gotRoleAudience, gotRequestedRoles := prepareRoles(context.Background(), tt.args.scope, tt.args.projectID, tt.args.projectRoleAssertion, tt.args.currentProjectOnly)
|
|
assert.ElementsMatch(t, tt.wantRoleAudience, gotRoleAudience, "roleAudience")
|
|
assert.ElementsMatch(t, tt.wantRequestedRoles, gotRequestedRoles, "requestedRoles")
|
|
})
|
|
}
|
|
}
|
|
|
|
func Test_userInfoToOIDC(t *testing.T) {
|
|
metadata := []query.UserMetadata{
|
|
{
|
|
Key: "key1",
|
|
Value: []byte{1, 2, 3},
|
|
},
|
|
{
|
|
Key: "key2",
|
|
Value: []byte{4, 5, 6},
|
|
},
|
|
}
|
|
organization := &query.UserInfoOrg{
|
|
ID: "orgID",
|
|
Name: "orgName",
|
|
PrimaryDomain: "orgDomain",
|
|
}
|
|
humanUserInfo := &query.OIDCUserInfo{
|
|
User: &query.User{
|
|
ID: "human1",
|
|
CreationDate: time.Unix(123, 456),
|
|
ChangeDate: time.Unix(567, 890),
|
|
ResourceOwner: "orgID",
|
|
Sequence: 22,
|
|
State: domain.UserStateActive,
|
|
Type: domain.UserTypeHuman,
|
|
Username: "username",
|
|
LoginNames: []string{"foo", "bar"},
|
|
PreferredLoginName: "foo",
|
|
Human: &query.Human{
|
|
FirstName: "user",
|
|
LastName: "name",
|
|
NickName: "foobar",
|
|
DisplayName: "xxx",
|
|
AvatarKey: "picture.png",
|
|
PreferredLanguage: language.Dutch,
|
|
Gender: domain.GenderDiverse,
|
|
Email: "foo@bar.com",
|
|
IsEmailVerified: true,
|
|
Phone: "+31123456789",
|
|
IsPhoneVerified: true,
|
|
},
|
|
},
|
|
Metadata: metadata,
|
|
Org: organization,
|
|
UserGrants: []query.UserGrant{
|
|
{
|
|
ID: "ug1",
|
|
CreationDate: time.Unix(444, 444),
|
|
ChangeDate: time.Unix(555, 555),
|
|
Sequence: 55,
|
|
Roles: []string{"role1", "role2"},
|
|
GrantID: "grantID",
|
|
State: domain.UserGrantStateActive,
|
|
UserID: "human1",
|
|
Username: "username",
|
|
ResourceOwner: "orgID",
|
|
ProjectID: "project1",
|
|
OrgName: "orgName",
|
|
OrgPrimaryDomain: "orgDomain",
|
|
ProjectName: "projectName",
|
|
UserResourceOwner: "org1",
|
|
},
|
|
},
|
|
}
|
|
machineUserInfo := &query.OIDCUserInfo{
|
|
User: &query.User{
|
|
ID: "machine1",
|
|
CreationDate: time.Unix(123, 456),
|
|
ChangeDate: time.Unix(567, 890),
|
|
ResourceOwner: "orgID",
|
|
Sequence: 23,
|
|
State: domain.UserStateActive,
|
|
Type: domain.UserTypeMachine,
|
|
Username: "machine",
|
|
PreferredLoginName: "meanMachine",
|
|
Machine: &query.Machine{
|
|
Name: "machine",
|
|
Description: "I'm a robot",
|
|
},
|
|
},
|
|
Org: organization,
|
|
UserGrants: []query.UserGrant{
|
|
{
|
|
ID: "ug1",
|
|
CreationDate: time.Unix(444, 444),
|
|
ChangeDate: time.Unix(555, 555),
|
|
Sequence: 55,
|
|
Roles: []string{"role1", "role2"},
|
|
GrantID: "grantID",
|
|
State: domain.UserGrantStateActive,
|
|
UserID: "human1",
|
|
Username: "username",
|
|
ResourceOwner: "orgID",
|
|
ProjectID: "project1",
|
|
OrgName: "orgName",
|
|
OrgPrimaryDomain: "orgDomain",
|
|
ProjectName: "projectName",
|
|
UserResourceOwner: "org1",
|
|
},
|
|
},
|
|
}
|
|
|
|
type args struct {
|
|
projectID string
|
|
user *query.OIDCUserInfo
|
|
scope []string
|
|
roleAudience []string
|
|
requestedRoles []string
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
args args
|
|
want *oidc.UserInfo
|
|
}{
|
|
{
|
|
name: "human, empty",
|
|
args: args{
|
|
projectID: "project1",
|
|
user: humanUserInfo,
|
|
},
|
|
want: &oidc.UserInfo{},
|
|
},
|
|
{
|
|
name: "machine, empty",
|
|
args: args{
|
|
projectID: "project1",
|
|
user: machineUserInfo,
|
|
},
|
|
want: &oidc.UserInfo{},
|
|
},
|
|
{
|
|
name: "human, scope openid",
|
|
args: args{
|
|
projectID: "project1",
|
|
user: humanUserInfo,
|
|
scope: []string{oidc.ScopeOpenID},
|
|
},
|
|
want: &oidc.UserInfo{
|
|
Subject: "human1",
|
|
},
|
|
},
|
|
{
|
|
name: "machine, scope openid",
|
|
args: args{
|
|
projectID: "project1",
|
|
user: machineUserInfo,
|
|
scope: []string{oidc.ScopeOpenID},
|
|
},
|
|
want: &oidc.UserInfo{
|
|
Subject: "machine1",
|
|
},
|
|
},
|
|
{
|
|
name: "human, scope email",
|
|
args: args{
|
|
projectID: "project1",
|
|
user: humanUserInfo,
|
|
scope: []string{oidc.ScopeEmail},
|
|
},
|
|
want: &oidc.UserInfo{
|
|
UserInfoEmail: oidc.UserInfoEmail{
|
|
Email: "foo@bar.com",
|
|
EmailVerified: true,
|
|
},
|
|
},
|
|
},
|
|
{
|
|
name: "machine, scope email",
|
|
args: args{
|
|
projectID: "project1",
|
|
user: machineUserInfo,
|
|
scope: []string{oidc.ScopeEmail},
|
|
},
|
|
want: &oidc.UserInfo{
|
|
UserInfoEmail: oidc.UserInfoEmail{},
|
|
},
|
|
},
|
|
{
|
|
name: "human, scope profile",
|
|
args: args{
|
|
projectID: "project1",
|
|
user: humanUserInfo,
|
|
scope: []string{oidc.ScopeProfile},
|
|
},
|
|
want: &oidc.UserInfo{
|
|
UserInfoProfile: oidc.UserInfoProfile{
|
|
Name: "xxx",
|
|
GivenName: "user",
|
|
FamilyName: "name",
|
|
Nickname: "foobar",
|
|
Picture: "https://foo.com/assets/orgID/picture.png",
|
|
Gender: "diverse",
|
|
Locale: oidc.NewLocale(language.Dutch),
|
|
UpdatedAt: oidc.FromTime(time.Unix(567, 890)),
|
|
PreferredUsername: "foo",
|
|
},
|
|
},
|
|
},
|
|
{
|
|
name: "machine, scope profile",
|
|
args: args{
|
|
projectID: "project1",
|
|
user: machineUserInfo,
|
|
scope: []string{oidc.ScopeProfile},
|
|
},
|
|
want: &oidc.UserInfo{
|
|
UserInfoProfile: oidc.UserInfoProfile{
|
|
Name: "machine",
|
|
UpdatedAt: oidc.FromTime(time.Unix(567, 890)),
|
|
PreferredUsername: "meanMachine",
|
|
},
|
|
},
|
|
},
|
|
{
|
|
name: "human, scope phone",
|
|
args: args{
|
|
projectID: "project1",
|
|
user: humanUserInfo,
|
|
scope: []string{oidc.ScopePhone},
|
|
},
|
|
want: &oidc.UserInfo{
|
|
UserInfoPhone: oidc.UserInfoPhone{
|
|
PhoneNumber: "+31123456789",
|
|
PhoneNumberVerified: true,
|
|
},
|
|
},
|
|
},
|
|
{
|
|
name: "machine, scope phone",
|
|
args: args{
|
|
projectID: "project1",
|
|
user: machineUserInfo,
|
|
scope: []string{oidc.ScopePhone},
|
|
},
|
|
want: &oidc.UserInfo{
|
|
UserInfoPhone: oidc.UserInfoPhone{},
|
|
},
|
|
},
|
|
{
|
|
name: "human, scope metadata",
|
|
args: args{
|
|
projectID: "project1",
|
|
user: humanUserInfo,
|
|
scope: []string{ScopeUserMetaData},
|
|
},
|
|
want: &oidc.UserInfo{
|
|
Claims: map[string]any{
|
|
ClaimUserMetaData: map[string]string{
|
|
"key1": base64.RawURLEncoding.EncodeToString([]byte{1, 2, 3}),
|
|
"key2": base64.RawURLEncoding.EncodeToString([]byte{4, 5, 6}),
|
|
},
|
|
},
|
|
},
|
|
},
|
|
{
|
|
name: "machine, scope metadata, none found",
|
|
args: args{
|
|
projectID: "project1",
|
|
user: machineUserInfo,
|
|
scope: []string{ScopeUserMetaData},
|
|
},
|
|
want: &oidc.UserInfo{},
|
|
},
|
|
{
|
|
name: "machine, scope resource owner",
|
|
args: args{
|
|
projectID: "project1",
|
|
user: machineUserInfo,
|
|
scope: []string{ScopeResourceOwner},
|
|
},
|
|
want: &oidc.UserInfo{
|
|
Claims: map[string]any{
|
|
ClaimResourceOwnerID: "orgID",
|
|
ClaimResourceOwnerName: "orgName",
|
|
ClaimResourceOwnerPrimaryDomain: "orgDomain",
|
|
},
|
|
},
|
|
},
|
|
{
|
|
name: "human, scope org primary domain prefix",
|
|
args: args{
|
|
projectID: "project1",
|
|
user: humanUserInfo,
|
|
scope: []string{domain.OrgDomainPrimaryScope + "foo.com"},
|
|
},
|
|
want: &oidc.UserInfo{
|
|
Claims: map[string]any{
|
|
domain.OrgDomainPrimaryClaim: "foo.com",
|
|
},
|
|
},
|
|
},
|
|
{
|
|
name: "machine, scope org id",
|
|
args: args{
|
|
projectID: "project1",
|
|
user: machineUserInfo,
|
|
scope: []string{domain.OrgIDScope + "orgID"},
|
|
},
|
|
want: &oidc.UserInfo{
|
|
Claims: map[string]any{
|
|
domain.OrgIDClaim: "orgID",
|
|
ClaimResourceOwnerID: "orgID",
|
|
ClaimResourceOwnerName: "orgName",
|
|
ClaimResourceOwnerPrimaryDomain: "orgDomain",
|
|
},
|
|
},
|
|
},
|
|
{
|
|
name: "human, roleAudience",
|
|
args: args{
|
|
projectID: "project1",
|
|
user: humanUserInfo,
|
|
roleAudience: []string{"project1"},
|
|
},
|
|
want: &oidc.UserInfo{
|
|
Claims: map[string]any{
|
|
ClaimProjectRoles: projectRoles{
|
|
"role1": {"orgID": "orgDomain"},
|
|
"role2": {"orgID": "orgDomain"},
|
|
},
|
|
fmt.Sprintf(ClaimProjectRolesFormat, "project1"): projectRoles{
|
|
"role1": {"orgID": "orgDomain"},
|
|
"role2": {"orgID": "orgDomain"},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
{
|
|
name: "human, requested roles",
|
|
args: args{
|
|
projectID: "project1",
|
|
user: humanUserInfo,
|
|
roleAudience: []string{"project1"},
|
|
requestedRoles: []string{"role2"},
|
|
},
|
|
want: &oidc.UserInfo{
|
|
Claims: map[string]any{
|
|
ClaimProjectRoles: projectRoles{
|
|
"role2": {"orgID": "orgDomain"},
|
|
},
|
|
fmt.Sprintf(ClaimProjectRolesFormat, "project1"): projectRoles{
|
|
"role2": {"orgID": "orgDomain"},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
assetPrefix := "https://foo.com/assets"
|
|
got := userInfoToOIDC(tt.args.projectID, tt.args.user, tt.args.scope, tt.args.roleAudience, tt.args.requestedRoles, assetPrefix)
|
|
assert.Equal(t, tt.want, got)
|
|
})
|
|
}
|
|
}
|