Implement confidential OIDC authentication boundary
This commit is contained in:
parent
0f888986d7
commit
a4e615096c
1 changed files with 1896 additions and 329 deletions
|
|
@ -11,6 +11,15 @@ spec:
|
|||
spec:
|
||||
automountServiceAccountToken: false
|
||||
enableServiceLinks: false
|
||||
dnsPolicy: None
|
||||
dnsConfig:
|
||||
nameservers: [10.96.0.53]
|
||||
searches:
|
||||
- nuthatch-testbed.svc.cluster.local
|
||||
- svc.cluster.local
|
||||
- cluster.local
|
||||
options:
|
||||
- {name: ndots, value: "5"}
|
||||
restartPolicy: Never
|
||||
initContainers:
|
||||
- name: credential-negative
|
||||
|
|
@ -57,18 +66,301 @@ spec:
|
|||
command: [/bin/sh, -ec]
|
||||
args:
|
||||
- |
|
||||
base="http://nuthatch-@@LANE@@:8080"
|
||||
curl --fail --silent --show-error "$base/healthz" | grep -F '"ok":true'
|
||||
curl --fail --silent --show-error "$base/readyz" | grep -F '"ready":true'
|
||||
curl --fail --silent --show-error \
|
||||
--cookie-jar /tmp/cookies \
|
||||
--dump-header /tmp/login-headers \
|
||||
--header 'Accept: application/json' \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{"username":"wp05-smoke"}' \
|
||||
"$base/login" >/tmp/login.json
|
||||
csrf="$(awk 'BEGIN{IGNORECASE=1} $1=="X-CSRF-Token:"{gsub("\r","",$2); print $2}' /tmp/login-headers)"
|
||||
base="https://nuthatch-@@LANE@@:8080"
|
||||
|
||||
curl() {
|
||||
command curl --insecure "$@"
|
||||
}
|
||||
|
||||
header_value() {
|
||||
awk -v expected="$2" '
|
||||
BEGIN { IGNORECASE=1 }
|
||||
$1 == expected ":" {
|
||||
sub(/^[^:]*:[[:space:]]*/, "")
|
||||
sub(/\r$/, "")
|
||||
print
|
||||
exit
|
||||
}
|
||||
' "$1"
|
||||
}
|
||||
|
||||
json_field() {
|
||||
tr -d '\n' < "$1" |
|
||||
sed -n 's/.*"'"$2"'"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p'
|
||||
}
|
||||
|
||||
oidc_callback_for() {
|
||||
user="$1"
|
||||
suffix="$2"
|
||||
authorization_url="$3"
|
||||
printf 'Completing %s authorization %s\n' \
|
||||
"$NUTHATCH_OIDC_PROVIDER" "$suffix" >&2
|
||||
case "$NUTHATCH_OIDC_PROVIDER" in
|
||||
keycloak)
|
||||
curl --fail --silent --show-error \
|
||||
--cookie-jar "/tmp/idp-$suffix" \
|
||||
--dump-header "/tmp/idp-start-$suffix.headers" \
|
||||
"$authorization_url" >"/tmp/idp-$suffix.html"
|
||||
action="$(
|
||||
sed -n 's/.*action="\([^"]*\)".*/\1/p' "/tmp/idp-$suffix.html" |
|
||||
head -n 1 |
|
||||
sed 's/&/\&/g'
|
||||
)"
|
||||
test -n "$action"
|
||||
curl --silent --show-error \
|
||||
--cookie "/tmp/idp-$suffix" \
|
||||
--cookie-jar "/tmp/idp-$suffix" \
|
||||
--dump-header "/tmp/idp-finish-$suffix.headers" \
|
||||
--data-urlencode "username=$user" \
|
||||
--data-urlencode "password=$NUTHATCH_OIDC_USER_PASSWORD" \
|
||||
--data-urlencode credentialId= \
|
||||
"$action" >"/tmp/idp-finish-$suffix.body"
|
||||
header_value "/tmp/idp-finish-$suffix.headers" Location
|
||||
;;
|
||||
zitadel)
|
||||
curl --silent --show-error \
|
||||
--dump-header "/tmp/idp-start-$suffix.headers" \
|
||||
"$authorization_url" >"/tmp/idp-start-$suffix.body"
|
||||
login_location="$(
|
||||
header_value "/tmp/idp-start-$suffix.headers" Location
|
||||
)"
|
||||
auth_request="${login_location##*authRequest=}"
|
||||
auth_request="${auth_request%%&*}"
|
||||
test -n "$auth_request"
|
||||
curl --fail --silent --show-error \
|
||||
--header "Authorization: Bearer $NUTHATCH_OIDC_LOGIN_PAT" \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data "{\"checks\":{\"user\":{\"userId\":\"$user\"},\"password\":{\"password\":\"$NUTHATCH_OIDC_USER_PASSWORD\"}},\"lifetime\":\"300s\"}" \
|
||||
"$NUTHATCH_OIDC_ISSUER/v2/sessions" \
|
||||
>"/tmp/session-$suffix.json"
|
||||
session_id="$(json_field "/tmp/session-$suffix.json" sessionId)"
|
||||
session_token="$(json_field "/tmp/session-$suffix.json" sessionToken)"
|
||||
test -n "$session_id"
|
||||
test -n "$session_token"
|
||||
curl --fail --silent --show-error \
|
||||
--header "Authorization: Bearer $NUTHATCH_OIDC_LOGIN_PAT" \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data "{\"session\":{\"sessionId\":\"$session_id\",\"sessionToken\":\"$session_token\"}}" \
|
||||
"$NUTHATCH_OIDC_ISSUER/v2/oidc/auth_requests/$auth_request" \
|
||||
>"/tmp/finalize-$suffix.json"
|
||||
json_field "/tmp/finalize-$suffix.json" callbackUrl |
|
||||
sed 's/\\u0026/\&/g; s#\\/#/#g'
|
||||
;;
|
||||
*)
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
login() {
|
||||
user="$1"
|
||||
suffix="$2"
|
||||
cookies="/tmp/cookies-$suffix"
|
||||
printf 'Starting login %s\n' "$suffix" >&2
|
||||
curl --insecure --silent --show-error \
|
||||
--cookie-jar "$cookies" \
|
||||
--dump-header "/tmp/login-$suffix.headers" \
|
||||
"$base/login" >"/tmp/login-$suffix.body"
|
||||
test "$(header_value "/tmp/login-$suffix.headers" Status 2>/dev/null || true)" = ""
|
||||
authorization_url="$(
|
||||
header_value "/tmp/login-$suffix.headers" Location
|
||||
)"
|
||||
test -n "$authorization_url"
|
||||
grep -i '^set-cookie: nuthatch_oidc=' "/tmp/login-$suffix.headers" |
|
||||
grep -i 'secure' |
|
||||
grep -i 'httponly' |
|
||||
grep -i 'samesite=lax' |
|
||||
grep -i 'path=/oidc/callback' >/dev/null
|
||||
state="$(
|
||||
printf '%s' "$authorization_url" |
|
||||
sed -n 's/.*[?&]state=\([^&]*\).*/\1/p'
|
||||
)"
|
||||
test -n "$state"
|
||||
if [ "$suffix" = a ]; then
|
||||
wrong_redirect_url="$(
|
||||
printf '%s' "$authorization_url" |
|
||||
sed 's#redirect_uri=[^&]*#redirect_uri=https%3A%2F%2Finvalid.example%2Fcallback#'
|
||||
)"
|
||||
wrong_redirect_status="$(
|
||||
curl --silent --output /dev/null \
|
||||
--write-out '%{http_code}' \
|
||||
"$wrong_redirect_url"
|
||||
)"
|
||||
test "$wrong_redirect_status" -ge 400
|
||||
printf 'Redirect URI rejection passed\n' >&2
|
||||
fi
|
||||
if curl --insecure --fail --silent \
|
||||
--cookie "$cookies" \
|
||||
"$base/oidc/callback?code=unused&state=invalid-$state" >/dev/null; then
|
||||
exit 1
|
||||
fi
|
||||
if [ "$suffix" = a ]; then
|
||||
transaction="$(
|
||||
awk -F '\t' '$6 == "nuthatch_oidc" { print $7 }' "$cookies"
|
||||
)"
|
||||
test "${#transaction}" -gt 1
|
||||
tampered_transaction="x${transaction#?}"
|
||||
test "$(
|
||||
curl --insecure --silent --output /dev/null \
|
||||
--write-out '%{http_code}' \
|
||||
--header 'Cookie: nuthatch_oidc=malformed' \
|
||||
"$base/oidc/callback?code=unused&state=$state"
|
||||
)" = 400
|
||||
test "$(
|
||||
curl --insecure --silent --output /dev/null \
|
||||
--write-out '%{http_code}' \
|
||||
--header "Cookie: nuthatch_oidc=$tampered_transaction" \
|
||||
"$base/oidc/callback?code=unused&state=$state"
|
||||
)" = 400
|
||||
fi
|
||||
callback="$(
|
||||
oidc_callback_for "$user" "$suffix" "$authorization_url"
|
||||
)"
|
||||
test -n "$callback"
|
||||
printf 'Authorization callback received %s\n' "$suffix" >&2
|
||||
callback_status="$(
|
||||
curl --insecure --silent --show-error \
|
||||
--output "/tmp/callback-$suffix.body" \
|
||||
--write-out '%{http_code}' \
|
||||
--cookie "$cookies" \
|
||||
--cookie-jar "$cookies" \
|
||||
--dump-header "/tmp/callback-$suffix.headers" \
|
||||
"$callback"
|
||||
)"
|
||||
printf 'Application callback status=%s %s\n' \
|
||||
"$callback_status" "$suffix" >&2
|
||||
if [ "$callback_status" != 303 ]; then
|
||||
sed -n '1,8p' "/tmp/callback-$suffix.body" >&2
|
||||
exit 1
|
||||
fi
|
||||
test "$(header_value "/tmp/callback-$suffix.headers" Location)" = "/"
|
||||
printf 'Application callback accepted %s\n' "$suffix" >&2
|
||||
sed -n \
|
||||
's/^\([Ss]et-[Cc]ookie: [^=]*\)=.*/\1=<redacted>/p' \
|
||||
"/tmp/callback-$suffix.headers" >&2
|
||||
session_cookie="$(
|
||||
grep -i '^set-cookie: nuthatch_session=' "/tmp/callback-$suffix.headers"
|
||||
)"
|
||||
csrf_cookie="$(
|
||||
grep -i '^set-cookie: nuthatch_csrf=' "/tmp/callback-$suffix.headers"
|
||||
)"
|
||||
transaction_cookie="$(
|
||||
grep -i '^set-cookie: nuthatch_oidc=' "/tmp/callback-$suffix.headers"
|
||||
)"
|
||||
printf '%s' "$session_cookie" |
|
||||
grep -i secure |
|
||||
grep -i httponly |
|
||||
grep -i samesite=lax |
|
||||
grep -i 'path=/;' >/dev/null
|
||||
printf '%s' "$csrf_cookie" |
|
||||
grep -i secure |
|
||||
grep -i samesite=lax |
|
||||
grep -iv httponly |
|
||||
grep -i 'path=/;' >/dev/null
|
||||
printf '%s' "$transaction_cookie" |
|
||||
grep -i 'max-age=0' |
|
||||
grep -i 'path=/oidc/callback;' >/dev/null
|
||||
if printf '%s\n%s\n%s\n' \
|
||||
"$session_cookie" "$csrf_cookie" "$transaction_cookie" |
|
||||
grep -qi 'domain='; then
|
||||
exit 1
|
||||
fi
|
||||
printf 'Cookie attributes passed %s\n' "$suffix" >&2
|
||||
awk -F '\t' '
|
||||
NF == 7 {
|
||||
printf "Stored cookie %s value-length=%d\n", $6, length($7) > "/dev/stderr"
|
||||
}
|
||||
$6 == "nuthatch_csrf" { print $7 }
|
||||
' "$cookies"
|
||||
}
|
||||
|
||||
curl --insecure --fail --silent --show-error "$base/healthz" |
|
||||
grep -F '"ok":true'
|
||||
curl --insecure --fail --silent --show-error "$base/readyz" |
|
||||
grep -F '"ready":true'
|
||||
curl --insecure --fail --silent --show-error "$base/nuthatch.js" |
|
||||
grep -F 'nuthatch'
|
||||
{
|
||||
curl --insecure --fail --silent --show-error "$base/nuthatch.js"
|
||||
curl --insecure --silent --show-error "$base/login"
|
||||
} > /tmp/browser-visible
|
||||
if grep -Ei \
|
||||
'NUTHATCH_S3|AWS_ACCESS_KEY|AWS_SECRET_ACCESS_KEY|client_secret' \
|
||||
/tmp/browser-visible; then
|
||||
exit 1
|
||||
fi
|
||||
test "$(
|
||||
curl --insecure --silent --output /dev/null \
|
||||
--write-out '%{http_code}' \
|
||||
--request POST \
|
||||
"$base/login"
|
||||
)" = 405
|
||||
test "$(
|
||||
curl --insecure --silent --output /dev/null \
|
||||
--write-out '%{http_code}' \
|
||||
"$base/"
|
||||
)" = 303
|
||||
test "$(
|
||||
curl --insecure --silent --output /dev/null \
|
||||
--write-out '%{http_code}' \
|
||||
"$base/download?root=personal&path=unauthenticated"
|
||||
)" = 303
|
||||
unauthenticated_digest="$(
|
||||
printf x | sha256sum | cut -d' ' -f1
|
||||
)"
|
||||
test "$(
|
||||
curl --insecure --silent --output /dev/null \
|
||||
--write-out '%{http_code}' \
|
||||
--header 'X-Declared-Size: 1' \
|
||||
--header "X-Content-SHA256: $unauthenticated_digest" \
|
||||
--header 'X-CSRF-Token: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' \
|
||||
--data x \
|
||||
"$base/upload?root=personal&path=unauthenticated&operation_id=40000000-0000-4000-8000-000000000001"
|
||||
)" = 303
|
||||
test "$(
|
||||
curl --insecure --silent --output /dev/null \
|
||||
--write-out '%{http_code}' \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{"root":"personal","path":"unauthenticated","operation_id":"40000000-0000-4000-8000-000000000002","csrf":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}' \
|
||||
"$base/delete"
|
||||
)" = 303
|
||||
test "$(
|
||||
curl --insecure --silent --output /dev/null \
|
||||
--write-out '%{http_code}' \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{"root":"personal","path":"unauthenticated","csrf":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}' \
|
||||
"$base/delete-prefix"
|
||||
)" = 303
|
||||
test "$(
|
||||
curl --insecure --silent --output /dev/null \
|
||||
--write-out '%{http_code}' \
|
||||
--header 'X-CSRF-Token: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' \
|
||||
--request POST \
|
||||
"$base/logout"
|
||||
)" = 303
|
||||
printf 'Unauthenticated boundary probes passed\n'
|
||||
|
||||
csrf="$(login "$NUTHATCH_OIDC_USER_A" a)"
|
||||
test -n "$csrf"
|
||||
cookies=/tmp/cookies-a
|
||||
printf 'Login a completed csrf-length=%d\n' "${#csrf}"
|
||||
authenticated_status="$(
|
||||
curl --insecure --silent --output /tmp/authenticated.body \
|
||||
--write-out '%{http_code}' \
|
||||
--cookie "$cookies" \
|
||||
"$base/"
|
||||
)"
|
||||
printf 'Authenticated browse status=%s\n' "$authenticated_status"
|
||||
test "$authenticated_status" = 200
|
||||
curl --insecure --fail --silent --show-error \
|
||||
--cookie "$cookies" \
|
||||
--header 'Accept: application/json' \
|
||||
"$base/" >/tmp/authenticated.json
|
||||
if grep -Ei \
|
||||
'NUTHATCH_S3|AWS_ACCESS_KEY|AWS_SECRET_ACCESS_KEY|client_secret' \
|
||||
/tmp/authenticated.body /tmp/authenticated.json; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
exercise_root() {
|
||||
root="$1"
|
||||
|
|
@ -78,22 +370,28 @@ spec:
|
|||
printf '%s' "$first" >/tmp/body
|
||||
size="$(wc -c </tmp/body | tr -d ' ')"
|
||||
digest="$(sha256sum /tmp/body | cut -d' ' -f1)"
|
||||
curl --fail --silent --show-error \
|
||||
--cookie /tmp/cookies \
|
||||
upload_status="$(
|
||||
curl --silent --show-error \
|
||||
--output /tmp/upload.json \
|
||||
--write-out '%{http_code}' \
|
||||
--cookie "$cookies" \
|
||||
--header 'Content-Type: application/octet-stream' \
|
||||
--header "X-Declared-Size: $size" \
|
||||
--header "X-Content-SHA256: $digest" \
|
||||
--header "X-CSRF-Token: $csrf" \
|
||||
--data-binary @/tmp/body \
|
||||
"$base/upload?root=$root&path=smoke-$suffix.txt&operation_id=00000000-0000-4000-8000-0000000000${suffix}" |
|
||||
grep -F '"result":"succeeded"'
|
||||
"$base/upload?root=$root&path=smoke-$suffix.txt&operation_id=00000000-0000-4000-8000-0000000000${suffix}"
|
||||
)"
|
||||
printf 'Upload %s status=%s\n' "$root" "$upload_status"
|
||||
test "$upload_status" = 200
|
||||
grep -F '"result":"succeeded"' /tmp/upload.json
|
||||
curl --fail --silent --show-error \
|
||||
--cookie /tmp/cookies \
|
||||
--cookie "$cookies" \
|
||||
--header 'Accept: application/json' \
|
||||
"$base/?root=$root" |
|
||||
grep -F "smoke-$suffix.txt"
|
||||
curl --fail --silent --show-error \
|
||||
--cookie /tmp/cookies \
|
||||
--cookie "$cookies" \
|
||||
"$base/download?root=$root&path=smoke-$suffix.txt" >/tmp/download
|
||||
test "$(cat /tmp/download)" = "$first"
|
||||
|
||||
|
|
@ -101,7 +399,7 @@ spec:
|
|||
size="$(wc -c </tmp/body | tr -d ' ')"
|
||||
digest="$(sha256sum /tmp/body | cut -d' ' -f1)"
|
||||
curl --fail --silent --show-error \
|
||||
--cookie /tmp/cookies \
|
||||
--cookie "$cookies" \
|
||||
--header 'Content-Type: application/octet-stream' \
|
||||
--header "X-Declared-Size: $size" \
|
||||
--header "X-Content-SHA256: $digest" \
|
||||
|
|
@ -110,18 +408,18 @@ spec:
|
|||
"$base/upload?root=$root&path=smoke-$suffix.txt&operation_id=10000000-0000-4000-8000-0000000000${suffix}" |
|
||||
grep -F '"result":"succeeded"'
|
||||
curl --fail --silent --show-error \
|
||||
--cookie /tmp/cookies \
|
||||
--cookie "$cookies" \
|
||||
"$base/download?root=$root&path=smoke-$suffix.txt" >/tmp/download
|
||||
test "$(cat /tmp/download)" = "$second"
|
||||
|
||||
curl --fail --silent --show-error \
|
||||
--cookie /tmp/cookies \
|
||||
--cookie "$cookies" \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data "{\"root\":\"$root\",\"path\":\"smoke-$suffix.txt\",\"operation_id\":\"20000000-0000-4000-8000-0000000000${suffix}\",\"csrf\":\"$csrf\"}" \
|
||||
"$base/delete" |
|
||||
grep -F '"result":"succeeded"'
|
||||
if curl --fail --silent \
|
||||
--cookie /tmp/cookies \
|
||||
--cookie "$cookies" \
|
||||
"$base/download?root=$root&path=smoke-$suffix.txt" >/dev/null; then
|
||||
exit 1
|
||||
fi
|
||||
|
|
@ -129,7 +427,152 @@ spec:
|
|||
|
||||
exercise_root personal 01
|
||||
exercise_root shared 02
|
||||
printf 'WP-05 app smoke passed\n'
|
||||
printf private-a >/tmp/body
|
||||
size="$(wc -c </tmp/body | tr -d ' ')"
|
||||
digest="$(sha256sum /tmp/body | cut -d' ' -f1)"
|
||||
curl --insecure --fail --silent --show-error \
|
||||
--cookie "$cookies" \
|
||||
--header 'Content-Type: application/octet-stream' \
|
||||
--header "X-Declared-Size: $size" \
|
||||
--header "X-Content-SHA256: $digest" \
|
||||
--header "X-CSRF-Token: $csrf" \
|
||||
--data-binary @/tmp/body \
|
||||
"$base/upload?root=personal&path=cross-user.txt&operation_id=30000000-0000-4000-8000-000000000001" |
|
||||
grep -F '"result":"succeeded"'
|
||||
curl --insecure --fail --silent --show-error \
|
||||
--cookie "$cookies" \
|
||||
--header 'Content-Type: application/octet-stream' \
|
||||
--header "X-Declared-Size: $size" \
|
||||
--header "X-Content-SHA256: $digest" \
|
||||
--header "X-CSRF-Token: $csrf" \
|
||||
--data-binary @/tmp/body \
|
||||
"$base/upload?root=shared&path=cross-user.txt&operation_id=30000000-0000-4000-8000-000000000002" |
|
||||
grep -F '"result":"succeeded"'
|
||||
|
||||
csrf_b="$(login "$NUTHATCH_OIDC_USER_B" b)"
|
||||
test -n "$csrf_b"
|
||||
|
||||
curl --insecure --silent --show-error \
|
||||
--cookie-jar /tmp/cookies-pkce \
|
||||
--dump-header /tmp/login-pkce.headers \
|
||||
"$base/login" >/tmp/login-pkce.body
|
||||
pkce_authorization_url="$(
|
||||
header_value /tmp/login-pkce.headers Location
|
||||
)"
|
||||
pkce_callback="$(
|
||||
oidc_callback_for \
|
||||
"$NUTHATCH_OIDC_USER_A" \
|
||||
pkce \
|
||||
"$pkce_authorization_url"
|
||||
)"
|
||||
pkce_code="$(
|
||||
printf '%s' "$pkce_callback" |
|
||||
sed -n 's/.*[?&]code=\([^&]*\).*/\1/p'
|
||||
)"
|
||||
test -n "$pkce_code"
|
||||
curl --fail --silent --show-error \
|
||||
"$NUTHATCH_OIDC_ISSUER/.well-known/openid-configuration" \
|
||||
>/tmp/discovery.json
|
||||
token_endpoint="$(json_field /tmp/discovery.json token_endpoint)"
|
||||
test -n "$token_endpoint"
|
||||
pkce_status="$(
|
||||
curl --silent --output /tmp/pkce-error.json \
|
||||
--write-out '%{http_code}' \
|
||||
--user "$NUTHATCH_OIDC_CLIENT_ID:$NUTHATCH_OIDC_CLIENT_SECRET" \
|
||||
--data-urlencode grant_type=authorization_code \
|
||||
--data-urlencode "code=$pkce_code" \
|
||||
--data-urlencode "redirect_uri=$NUTHATCH_OIDC_REDIRECT_URI" \
|
||||
--data-urlencode code_verifier=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa \
|
||||
"$token_endpoint"
|
||||
)"
|
||||
test "$pkce_status" -ge 400
|
||||
if curl --insecure --fail --silent --show-error \
|
||||
--cookie /tmp/cookies-b \
|
||||
--header 'Accept: application/json' \
|
||||
"$base/?root=personal" |
|
||||
grep -F cross-user.txt; then
|
||||
exit 1
|
||||
fi
|
||||
curl --insecure --fail --silent --show-error \
|
||||
--cookie /tmp/cookies-b \
|
||||
--header 'Accept: application/json' \
|
||||
"$base/?root=shared" |
|
||||
grep -F cross-user.txt
|
||||
|
||||
if curl --insecure --fail --silent \
|
||||
--cookie "$cookies" \
|
||||
--header 'X-CSRF-Token: invalid' \
|
||||
--request POST \
|
||||
"$base/logout" >/dev/null; then
|
||||
exit 1
|
||||
fi
|
||||
curl --insecure --fail --silent --show-error \
|
||||
--cookie "$cookies" \
|
||||
--cookie-jar "$cookies" \
|
||||
--dump-header /tmp/logout.headers \
|
||||
--header "X-CSRF-Token: $csrf" \
|
||||
--request POST \
|
||||
"$base/logout" >/dev/null
|
||||
grep -i '^set-cookie: nuthatch_session=' /tmp/logout.headers |
|
||||
grep -i 'max-age=0' >/dev/null
|
||||
grep -i '^set-cookie: nuthatch_csrf=' /tmp/logout.headers |
|
||||
grep -i 'max-age=0' >/dev/null
|
||||
grep -i '^set-cookie: nuthatch_oidc=' /tmp/logout.headers |
|
||||
grep -i 'max-age=0' |
|
||||
grep -i 'path=/oidc/callback' >/dev/null
|
||||
test "$(
|
||||
curl --insecure --silent --output /dev/null \
|
||||
--write-out '%{http_code}' \
|
||||
--cookie "$cookies" \
|
||||
"$base/"
|
||||
)" = 303
|
||||
printf 'OIDC app smoke passed\n'
|
||||
env:
|
||||
- name: NUTHATCH_OIDC_PROVIDER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: @@PROFILE_NAME@@
|
||||
key: NUTHATCH_OIDC_PROVIDER
|
||||
- name: NUTHATCH_OIDC_ISSUER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: @@PROFILE_NAME@@
|
||||
key: NUTHATCH_OIDC_ISSUER
|
||||
- name: NUTHATCH_OIDC_USER_A
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: @@PROFILE_NAME@@
|
||||
key: NUTHATCH_OIDC_USER_A
|
||||
- name: NUTHATCH_OIDC_USER_B
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: @@PROFILE_NAME@@
|
||||
key: NUTHATCH_OIDC_USER_B
|
||||
- name: NUTHATCH_OIDC_USER_PASSWORD
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: @@PROFILE_NAME@@
|
||||
key: NUTHATCH_OIDC_USER_PASSWORD
|
||||
- name: NUTHATCH_OIDC_CLIENT_ID
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: @@PROFILE_NAME@@
|
||||
key: NUTHATCH_OIDC_CLIENT_ID
|
||||
- name: NUTHATCH_OIDC_REDIRECT_URI
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: @@PROFILE_NAME@@
|
||||
key: NUTHATCH_OIDC_REDIRECT_URI
|
||||
- name: NUTHATCH_OIDC_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: nuthatch-@@LANE@@
|
||||
key: NUTHATCH_OIDC_CLIENT_SECRET
|
||||
- name: NUTHATCH_OIDC_LOGIN_PAT
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: nuthatch-oidc-automation-@@LANE@@
|
||||
key: NUTHATCH_OIDC_LOGIN_PAT
|
||||
resources:
|
||||
requests: {cpu: 50m, memory: 32Mi}
|
||||
limits: {cpu: "1", memory: 128Mi}
|
||||
|
|
|
|||
Loading…
Reference in a new issue