github/kubelogin
1
0
Fork 0
mirror of https://github.com/int128/kubelogin.git synced 2026-08-23 21:06:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #271 from int128/refactor

Browse Source 
Refactor integration test
This commit is contained in:
Hidetake Iwata
2020-04-10 20:39:18 +09:00
committed by GitHub
parent 3fb074a4a8 d5c738697f
commit 695347e419
14 changed files with 152 additions and 105 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integration_test/credetial_plugin_test.go
+84 -63
View File
@@ -11,7 +11,7 @@ import (
"github.com/google/go-cmp/cmp"
"github.com/int128/kubelogin/integration_test/idp"
"github.com/int128/kubelogin/integration_test/idp/mock_idp"
"github.com/int128/kubelogin/integration_test/keys"
"github.com/int128/kubelogin/integration_test/keypair"
"github.com/int128/kubelogin/integration_test/localserver"
"github.com/int128/kubelogin/pkg/adaptors/browser"
"github.com/int128/kubelogin/pkg/adaptors/browser/mock_browser"
@@ -43,9 +43,9 @@ func TestCredentialPlugin(t *testing.T) {
t.Run("NoTLS", func(t *testing.T) {
testCredentialPlugin(t, credentialPluginTestCase{
TokenCacheDir: tokenCacheDir,
Keys: keys.None,
ExtraArgs: []string{
tokenCacheDir: tokenCacheDir,
idpTLS: keypair.None,
extraArgs: []string{
"--token-cache-dir", tokenCacheDir,
},
})
@@ -53,23 +53,23 @@ func TestCredentialPlugin(t *testing.T) {
t.Run("TLS", func(t *testing.T) {
t.Run("CertFile", func(t *testing.T) {
testCredentialPlugin(t, credentialPluginTestCase{
TokenCacheDir: tokenCacheDir,
TokenCacheKey: tokencache.Key{CACertFilename: keys.Server.CACertPath},
Keys: keys.Server,
ExtraArgs: []string{
tokenCacheDir: tokenCacheDir,
tokenCacheKey: tokencache.Key{CACertFilename: keypair.Server.CACertPath},
idpTLS: keypair.Server,
extraArgs: []string{
"--token-cache-dir", tokenCacheDir,
"--certificate-authority", keys.Server.CACertPath,
"--certificate-authority", keypair.Server.CACertPath,
},
})
})
t.Run("CertData", func(t *testing.T) {
testCredentialPlugin(t, credentialPluginTestCase{
TokenCacheDir: tokenCacheDir,
TokenCacheKey: tokencache.Key{CACertData: keys.Server.CACertBase64},
Keys: keys.Server,
ExtraArgs: []string{
tokenCacheDir: tokenCacheDir,
tokenCacheKey: tokencache.Key{CACertData: keypair.Server.CACertBase64},
idpTLS: keypair.Server,
extraArgs: []string{
"--token-cache-dir", tokenCacheDir,
"--certificate-authority-data", keys.Server.CACertBase64,
"--certificate-authority-data", keypair.Server.CACertBase64,
},
})
})
@@ -77,10 +77,10 @@ func TestCredentialPlugin(t *testing.T) {
}
type credentialPluginTestCase struct {
TokenCacheDir string
TokenCacheKey tokencache.Key
Keys keys.Keys
ExtraArgs []string
tokenCacheDir string
tokenCacheKey tokencache.Key
idpTLS keypair.KeyPair
extraArgs []string
}
func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) {
@@ -94,18 +94,22 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) {
defer ctrl.Finish()
provider := mock_idp.NewMockProvider(ctrl)
serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.Keys)
serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.idpTLS)
defer server.Shutdown(t, ctx)
var idToken string
setupAuthCodeFlow(t, provider, serverURL, "openid", "http://localhost:", nil, &idToken)
writerMock := newCredentialPluginWriterMock(t, ctrl, &idToken)
browserMock := newBrowserMock(ctx, t, ctrl, tc.Keys)
cfg := authCodeFlowConfig{
serverURL: serverURL,
scope: "openid",
redirectURIPrefix: "http://localhost:",
}
setupAuthCodeFlow(t, provider, &cfg)
writerMock := newCredentialPluginWriterMock(t, ctrl, &cfg.idToken)
browserMock := newBrowserMock(ctx, t, ctrl, tc.idpTLS)
args := []string{
"--oidc-issuer-url", serverURL,
"--oidc-client-id", "kubernetes",
}
args = append(args, tc.ExtraArgs...)
args = append(args, tc.extraArgs...)
runGetTokenCmd(t, ctx, browserMock, writerMock, args)
})
@@ -117,7 +121,7 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) {
defer ctrl.Finish()
provider := mock_idp.NewMockProvider(ctrl)
serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.Keys)
serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.idpTLS)
defer server.Shutdown(t, ctx)
idToken := newIDToken(t, serverURL, "", tokenExpiryFuture)
setupROPCFlow(provider, serverURL, "openid", "USER", "PASS", idToken)
@@ -130,7 +134,7 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) {
"--username", "USER",
"--password", "PASS",
}
args = append(args, tc.ExtraArgs...)
args = append(args, tc.extraArgs...)
runGetTokenCmd(t, ctx, browserMock, writerMock, args)
})
@@ -142,7 +146,7 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) {
defer ctrl.Finish()
provider := mock_idp.NewMockProvider(ctrl)
serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.Keys)
serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.idpTLS)
defer server.Shutdown(t, ctx)
idToken := newIDToken(t, serverURL, "YOUR_NONCE", tokenExpiryFuture)
writerMock := newCredentialPluginWriterMock(t, ctrl, &idToken)
@@ -156,7 +160,7 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) {
"--oidc-issuer-url", serverURL,
"--oidc-client-id", "kubernetes",
}
args = append(args, tc.ExtraArgs...)
args = append(args, tc.extraArgs...)
runGetTokenCmd(t, ctx, browserMock, writerMock, args)
assertTokenCache(t, tc, serverURL, tokencache.Value{
IDToken: idToken,
@@ -172,7 +176,7 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) {
defer ctrl.Finish()
provider := mock_idp.NewMockProvider(ctrl)
serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.Keys)
serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.idpTLS)
defer server.Shutdown(t, ctx)
validIDToken := newIDToken(t, serverURL, "YOUR_NONCE", tokenExpiryFuture)
expiredIDToken := newIDToken(t, serverURL, "YOUR_NONCE", tokenExpiryPast)
@@ -193,7 +197,7 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) {
"--oidc-issuer-url", serverURL,
"--oidc-client-id", "kubernetes",
}
args = append(args, tc.ExtraArgs...)
args = append(args, tc.extraArgs...)
runGetTokenCmd(t, ctx, browserMock, writerMock, args)
assertTokenCache(t, tc, serverURL, tokencache.Value{
IDToken: validIDToken,
@@ -209,31 +213,35 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) {
defer ctrl.Finish()
provider := mock_idp.NewMockProvider(ctrl)
serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.Keys)
serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.idpTLS)
defer server.Shutdown(t, ctx)
validIDToken := newIDToken(t, serverURL, "YOUR_NONCE", tokenExpiryFuture)
expiredIDToken := newIDToken(t, serverURL, "YOUR_NONCE", tokenExpiryPast)
setupAuthCodeFlow(t, provider, serverURL, "openid", "http://localhost:", nil, &validIDToken)
cfg := authCodeFlowConfig{
serverURL: serverURL,
scope: "openid",
redirectURIPrefix: "http://localhost:",
}
setupAuthCodeFlow(t, provider, &cfg)
provider.EXPECT().Refresh("EXPIRED_REFRESH_TOKEN").
Return(nil, &idp.ErrorResponse{Code: "invalid_request", Description: "token has expired"}).
MaxTimes(2) // package oauth2 will retry refreshing the token
expiredIDToken := newIDToken(t, serverURL, "YOUR_NONCE", tokenExpiryPast)
setupTokenCache(t, tc, serverURL, tokencache.Value{
IDToken: expiredIDToken,
RefreshToken: "EXPIRED_REFRESH_TOKEN",
})
writerMock := newCredentialPluginWriterMock(t, ctrl, &validIDToken)
browserMock := newBrowserMock(ctx, t, ctrl, tc.Keys)
writerMock := newCredentialPluginWriterMock(t, ctrl, &cfg.idToken)
browserMock := newBrowserMock(ctx, t, ctrl, tc.idpTLS)
args := []string{
"--oidc-issuer-url", serverURL,
"--oidc-client-id", "kubernetes",
}
args = append(args, tc.ExtraArgs...)
args = append(args, tc.extraArgs...)
runGetTokenCmd(t, ctx, browserMock, writerMock, args)
assertTokenCache(t, tc, serverURL, tokencache.Value{
IDToken: validIDToken,
IDToken: cfg.idToken,
RefreshToken: "YOUR_REFRESH_TOKEN",
})
})
@@ -246,12 +254,16 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) {
defer ctrl.Finish()
provider := mock_idp.NewMockProvider(ctrl)
serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.Keys)
serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.idpTLS)
defer server.Shutdown(t, ctx)
var idToken string
setupAuthCodeFlow(t, provider, serverURL, "email profile openid", "http://localhost:", nil, &idToken)
writerMock := newCredentialPluginWriterMock(t, ctrl, &idToken)
browserMock := newBrowserMock(ctx, t, ctrl, tc.Keys)
cfg := authCodeFlowConfig{
serverURL: serverURL,
scope: "email profile openid",
redirectURIPrefix: "http://localhost:",
}
setupAuthCodeFlow(t, provider, &cfg)
writerMock := newCredentialPluginWriterMock(t, ctrl, &cfg.idToken)
browserMock := newBrowserMock(ctx, t, ctrl, tc.idpTLS)
args := []string{
"--oidc-issuer-url", serverURL,
@@ -259,7 +271,7 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) {
"--oidc-extra-scope", "email",
"--oidc-extra-scope", "profile",
}
args = append(args, tc.ExtraArgs...)
args = append(args, tc.extraArgs...)
runGetTokenCmd(t, ctx, browserMock, writerMock, args)
})
@@ -271,19 +283,23 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) {
defer ctrl.Finish()
provider := mock_idp.NewMockProvider(ctrl)
serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.Keys)
serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.idpTLS)
defer server.Shutdown(t, ctx)
var idToken string
setupAuthCodeFlow(t, provider, serverURL, "openid", "http://127.0.0.1:", nil, &idToken)
writerMock := newCredentialPluginWriterMock(t, ctrl, &idToken)
browserMock := newBrowserMock(ctx, t, ctrl, tc.Keys)
cfg := authCodeFlowConfig{
serverURL: serverURL,
scope: "openid",
redirectURIPrefix: "http://127.0.0.1:",
}
setupAuthCodeFlow(t, provider, &cfg)
writerMock := newCredentialPluginWriterMock(t, ctrl, &cfg.idToken)
browserMock := newBrowserMock(ctx, t, ctrl, tc.idpTLS)
args := []string{
"--oidc-issuer-url", serverURL,
"--oidc-client-id", "kubernetes",
"--oidc-redirect-url-hostname", "127.0.0.1",
}
args = append(args, tc.ExtraArgs...)
args = append(args, tc.extraArgs...)
runGetTokenCmd(t, ctx, browserMock, writerMock, args)
})
@@ -295,15 +311,20 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) {
defer ctrl.Finish()
provider := mock_idp.NewMockProvider(ctrl)
serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.Keys)
serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), tc.idpTLS)
defer server.Shutdown(t, ctx)
var idToken string
setupAuthCodeFlow(t, provider, serverURL, "openid", "http://localhost:", map[string]string{
"ttl": "86400",
"reauth": "false",
}, &idToken)
writerMock := newCredentialPluginWriterMock(t, ctrl, &idToken)
browserMock := newBrowserMock(ctx, t, ctrl, tc.Keys)
cfg := authCodeFlowConfig{
serverURL: serverURL,
scope: "openid",
redirectURIPrefix: "http://localhost:",
extraParams: map[string]string{
"ttl": "86400",
"reauth": "false",
},
}
setupAuthCodeFlow(t, provider, &cfg)
writerMock := newCredentialPluginWriterMock(t, ctrl, &cfg.idToken)
browserMock := newBrowserMock(ctx, t, ctrl, tc.idpTLS)
args := []string{
"--oidc-issuer-url", serverURL,
@@ -311,7 +332,7 @@ func testCredentialPlugin(t *testing.T, tc credentialPluginTestCase) {
"--oidc-auth-request-extra-params", "ttl=86400",
"--oidc-auth-request-extra-params", "reauth=false",
}
args = append(args, tc.ExtraArgs...)
args = append(args, tc.extraArgs...)
runGetTokenCmd(t, ctx, browserMock, writerMock, args)
})
}
@@ -346,22 +367,22 @@ func runGetTokenCmd(t *testing.T, ctx context.Context, b browser.Interface, w cr
}
func setupTokenCache(t *testing.T, tc credentialPluginTestCase, serverURL string, v tokencache.Value) {
k := tc.TokenCacheKey
k := tc.tokenCacheKey
k.IssuerURL = serverURL
k.ClientID = "kubernetes"
var r tokencache.Repository
err := r.Save(tc.TokenCacheDir, k, v)
err := r.Save(tc.tokenCacheDir, k, v)
if err != nil {
t.Errorf("could not set up the token cache: %s", err)
}
}
func assertTokenCache(t *testing.T, tc credentialPluginTestCase, serverURL string, want tokencache.Value) {
k := tc.TokenCacheKey
k := tc.tokenCacheKey
k.IssuerURL = serverURL
k.ClientID = "kubernetes"
var r tokencache.Repository
got, err := r.FindByKey(tc.TokenCacheDir, k)
got, err := r.FindByKey(tc.tokenCacheDir, k)
if err != nil {
t.Errorf("could not set up the token cache: %s", err)
}
integration_test/helpers_test.go
+21 -11
View File
@@ -10,7 +10,7 @@ import (
"github.com/golang/mock/gomock"
"github.com/int128/kubelogin/integration_test/idp"
"github.com/int128/kubelogin/integration_test/idp/mock_idp"
"github.com/int128/kubelogin/integration_test/keys"
"github.com/int128/kubelogin/integration_test/keypair"
"github.com/int128/kubelogin/pkg/adaptors/browser"
"github.com/int128/kubelogin/pkg/adaptors/browser/mock_browser"
"github.com/int128/kubelogin/pkg/testing/jwt"
@@ -34,19 +34,29 @@ func newIDToken(t *testing.T, issuer, nonce string, expiry time.Time) string {
})
}
func setupAuthCodeFlow(t *testing.T, provider *mock_idp.MockProvider, serverURL, scope, redirectURIPrefix string, extraParams map[string]string, idToken *string) {
type authCodeFlowConfig struct {
serverURL string
scope string
redirectURIPrefix string
extraParams map[string]string
// setupAuthCodeFlow will set this after authentication
idToken string
}
func setupAuthCodeFlow(t *testing.T, provider *mock_idp.MockProvider, c *authCodeFlowConfig) {
var nonce string
provider.EXPECT().Discovery().Return(idp.NewDiscoveryResponse(serverURL))
provider.EXPECT().Discovery().Return(idp.NewDiscoveryResponse(c.serverURL))
provider.EXPECT().GetCertificates().Return(idp.NewCertificatesResponse(jwt.PrivateKey))
provider.EXPECT().AuthenticateCode(gomock.Any()).
DoAndReturn(func(req idp.AuthenticationRequest) (string, error) {
if req.Scope != scope {
t.Errorf("scope wants `%s` but was `%s`", scope, req.Scope)
if req.Scope != c.scope {
t.Errorf("scope wants `%s` but was `%s`", c.scope, req.Scope)
}
if !strings.HasPrefix(req.RedirectURI, redirectURIPrefix) {
t.Errorf("redirectURI wants prefix `%s` but was `%s`", redirectURIPrefix, req.RedirectURI)
if !strings.HasPrefix(req.RedirectURI, c.redirectURIPrefix) {
t.Errorf("redirectURI wants prefix `%s` but was `%s`", c.redirectURIPrefix, req.RedirectURI)
}
for k, v := range extraParams {
for k, v := range c.extraParams {
got := req.RawQuery.Get(k)
if got != v {
t.Errorf("parameter %s wants `%s` but was `%s`", k, v, got)
@@ -57,8 +67,8 @@ func setupAuthCodeFlow(t *testing.T, provider *mock_idp.MockProvider, serverURL,
})
provider.EXPECT().Exchange("YOUR_AUTH_CODE").
DoAndReturn(func(string) (*idp.TokenResponse, error) {
*idToken = newIDToken(t, serverURL, nonce, tokenExpiryFuture)
return idp.NewTokenResponse(*idToken, "YOUR_REFRESH_TOKEN"), nil
c.idToken = newIDToken(t, c.serverURL, nonce, tokenExpiryFuture)
return idp.NewTokenResponse(c.idToken, "YOUR_REFRESH_TOKEN"), nil
})
}
@@ -69,7 +79,7 @@ func setupROPCFlow(provider *mock_idp.MockProvider, serverURL, scope, username,
Return(idp.NewTokenResponse(idToken, "YOUR_REFRESH_TOKEN"), nil)
}
func newBrowserMock(ctx context.Context, t *testing.T, ctrl *gomock.Controller, k keys.Keys) browser.Interface {
func newBrowserMock(ctx context.Context, t *testing.T, ctrl *gomock.Controller, k keypair.KeyPair) browser.Interface {
b := mock_browser.NewMockInterface(ctrl)
b.EXPECT().
Open(gomock.Any()).
integration_test/keys/keys.go → integration_test/keypair/keypair.go
+11 -11
View File
@@ -1,4 +1,4 @@
package keys
package keypair
import (
"crypto/tls"
@@ -10,8 +10,8 @@ import (
"strings"
)
// Keys represents a pair of certificate and key.
type Keys struct {
// KeyPair represents a pair of certificate and key.
type KeyPair struct {
CertPath string
KeyPath string
CACertPath string
@@ -20,16 +20,16 @@ type Keys struct {
}
// None represents non-TLS.
var None Keys
var None KeyPair
// Server is a Keys for TLS server.
// Server is a KeyPair for TLS server.
// These files should be generated by Makefile before test.
var Server = Keys{
CertPath: "keys/testdata/server.crt",
KeyPath: "keys/testdata/server.key",
CACertPath: "keys/testdata/ca.crt",
CACertBase64: readAsBase64("keys/testdata/ca.crt"),
TLSConfig: newTLSConfig("keys/testdata/ca.crt"),
var Server = KeyPair{
CertPath: "keypair/testdata/server.crt",
KeyPath: "keypair/testdata/server.key",
CACertPath: "keypair/testdata/ca.crt",
CACertBase64: readAsBase64("keypair/testdata/ca.crt"),
TLSConfig: newTLSConfig("keypair/testdata/ca.crt"),
}
func readAsBase64(name string) string {
integration_test/keys/testdata/Makefile → integration_test/keypair/testdata/Makefile
Vendored
View File
integration_test/keys/testdata/ca.crt → integration_test/keypair/testdata/ca.crt
Vendored
View File
integration_test/keys/testdata/ca.csr → integration_test/keypair/testdata/ca.csr
Vendored
View File
integration_test/keys/testdata/ca.key → integration_test/keypair/testdata/ca.key
Vendored
View File
integration_test/keys/testdata/ca.srl → integration_test/keypair/testdata/ca.srl
Vendored
View File
integration_test/keys/testdata/openssl.cnf → integration_test/keypair/testdata/openssl.cnf
Vendored
View File
integration_test/keys/testdata/server.crt → integration_test/keypair/testdata/server.crt
Vendored
View File
integration_test/keys/testdata/server.csr → integration_test/keypair/testdata/server.csr
Vendored
View File
integration_test/keys/testdata/server.key → integration_test/keypair/testdata/server.key
Vendored
View File
integration_test/localserver/authserver.go
+4 -4
View File
@@ -9,7 +9,7 @@ import (
"net/http"
"testing"
"github.com/int128/kubelogin/integration_test/keys"
"github.com/int128/kubelogin/integration_test/keypair"
)
type Shutdowner interface {
@@ -31,8 +31,8 @@ func (s *shutdowner) Shutdown(t *testing.T, ctx context.Context) {
// Start starts an authentication server.
// If k is non-nil, it starts a TLS server.
func Start(t *testing.T, h http.Handler, k keys.Keys) (string, Shutdowner) {
if k == keys.None {
func Start(t *testing.T, h http.Handler, k keypair.KeyPair) (string, Shutdowner) {
if k == keypair.None {
return startNoTLS(t, h)
}
return startTLS(t, h, k)
@@ -54,7 +54,7 @@ func startNoTLS(t *testing.T, h http.Handler) (string, Shutdowner) {
return url, &shutdowner{l, s}
}
func startTLS(t *testing.T, h http.Handler, k keys.Keys) (string, Shutdowner) {
func startTLS(t *testing.T, h http.Handler, k keypair.KeyPair) (string, Shutdowner) {
t.Helper()
l, port := newLocalhostListener(t)
url := "https://localhost:" + port
integration_test/standalone_test.go
+32 -16
View File
@@ -9,7 +9,7 @@ import (
"github.com/golang/mock/gomock"
"github.com/int128/kubelogin/integration_test/idp"
"github.com/int128/kubelogin/integration_test/idp/mock_idp"
"github.com/int128/kubelogin/integration_test/keys"
"github.com/int128/kubelogin/integration_test/keypair"
"github.com/int128/kubelogin/integration_test/kubeconfig"
"github.com/int128/kubelogin/integration_test/localserver"
"github.com/int128/kubelogin/pkg/adaptors/browser"
@@ -28,14 +28,14 @@ import (
//
func TestStandalone(t *testing.T) {
t.Run("NoTLS", func(t *testing.T) {
testStandalone(t, keys.None)
testStandalone(t, keypair.None)
})
t.Run("TLS", func(t *testing.T) {
testStandalone(t, keys.Server)
testStandalone(t, keypair.Server)
})
}
func testStandalone(t *testing.T, idpTLS keys.Keys) {
func testStandalone(t *testing.T, idpTLS keypair.KeyPair) {
timeout := 5 * time.Second
t.Run("Defaults", func(t *testing.T) {
@@ -49,8 +49,12 @@ func testStandalone(t *testing.T, idpTLS keys.Keys) {
serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), idpTLS)
defer server.Shutdown(t, ctx)
browserMock := newBrowserMock(ctx, t, ctrl, idpTLS)
var idToken string
setupAuthCodeFlow(t, provider, serverURL, "openid", "http://localhost:", nil, &idToken)
cfg := authCodeFlowConfig{
serverURL: serverURL,
scope: "openid",
redirectURIPrefix: "http://localhost:",
}
setupAuthCodeFlow(t, provider, &cfg)
kubeConfigFilename := kubeconfig.Create(t, &kubeconfig.Values{
Issuer: serverURL,
IDPCertificateAuthority: idpTLS.CACertPath,
@@ -62,7 +66,7 @@ func testStandalone(t *testing.T, idpTLS keys.Keys) {
}
runRootCmd(t, ctx, browserMock, args)
kubeconfig.Verify(t, kubeConfigFilename, kubeconfig.AuthProviderConfig{
IDToken: idToken,
IDToken: cfg.idToken,
RefreshToken: "YOUR_REFRESH_TOKEN",
})
})
@@ -174,8 +178,12 @@ func testStandalone(t *testing.T, idpTLS keys.Keys) {
provider := mock_idp.NewMockProvider(ctrl)
serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), idpTLS)
defer server.Shutdown(t, ctx)
var idToken string
setupAuthCodeFlow(t, provider, serverURL, "openid", "http://localhost:", nil, &idToken)
cfg := authCodeFlowConfig{
serverURL: serverURL,
scope: "openid",
redirectURIPrefix: "http://localhost:",
}
setupAuthCodeFlow(t, provider, &cfg)
provider.EXPECT().Refresh("EXPIRED_REFRESH_TOKEN").
Return(nil, &idp.ErrorResponse{Code: "invalid_request", Description: "token has expired"}).
MaxTimes(2) // package oauth2 will retry refreshing the token
@@ -194,7 +202,7 @@ func testStandalone(t *testing.T, idpTLS keys.Keys) {
}
runRootCmd(t, ctx, browserMock, args)
kubeconfig.Verify(t, kubeConfigFilename, kubeconfig.AuthProviderConfig{
IDToken: idToken,
IDToken: cfg.idToken,
RefreshToken: "YOUR_REFRESH_TOKEN",
})
})
@@ -209,8 +217,12 @@ func testStandalone(t *testing.T, idpTLS keys.Keys) {
provider := mock_idp.NewMockProvider(ctrl)
serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), idpTLS)
defer server.Shutdown(t, ctx)
var idToken string
setupAuthCodeFlow(t, provider, serverURL, "openid", "http://localhost:", nil, &idToken)
cfg := authCodeFlowConfig{
serverURL: serverURL,
scope: "openid",
redirectURIPrefix: "http://localhost:",
}
setupAuthCodeFlow(t, provider, &cfg)
browserMock := newBrowserMock(ctx, t, ctrl, idpTLS)
kubeConfigFilename := kubeconfig.Create(t, &kubeconfig.Values{
@@ -226,7 +238,7 @@ func testStandalone(t *testing.T, idpTLS keys.Keys) {
}
runRootCmd(t, ctx, browserMock, args)
kubeconfig.Verify(t, kubeConfigFilename, kubeconfig.AuthProviderConfig{
IDToken: idToken,
IDToken: cfg.idToken,
RefreshToken: "YOUR_REFRESH_TOKEN",
})
})
@@ -241,8 +253,12 @@ func testStandalone(t *testing.T, idpTLS keys.Keys) {
provider := mock_idp.NewMockProvider(ctrl)
serverURL, server := localserver.Start(t, idp.NewHandler(t, provider), idpTLS)
defer server.Shutdown(t, ctx)
var idToken string
setupAuthCodeFlow(t, provider, serverURL, "profile groups openid", "http://localhost:", nil, &idToken)
cfg := authCodeFlowConfig{
serverURL: serverURL,
scope: "profile groups openid",
redirectURIPrefix: "http://localhost:",
}
setupAuthCodeFlow(t, provider, &cfg)
browserMock := newBrowserMock(ctx, t, ctrl, idpTLS)
kubeConfigFilename := kubeconfig.Create(t, &kubeconfig.Values{
@@ -257,7 +273,7 @@ func testStandalone(t *testing.T, idpTLS keys.Keys) {
}
runRootCmd(t, ctx, browserMock, args)
kubeconfig.Verify(t, kubeConfigFilename, kubeconfig.AuthProviderConfig{
IDToken: idToken,
IDToken: cfg.idToken,
RefreshToken: "YOUR_REFRESH_TOKEN",
})
})