|
| 1 | +package identity |
| 2 | + |
| 3 | +import ( |
| 4 | + "context" |
| 5 | + "fmt" |
| 6 | + "testing" |
| 7 | + |
| 8 | + "github.com/jetstack/preflight/pkg/internal/cyberark/servicediscovery" |
| 9 | +) |
| 10 | + |
| 11 | +func Test_IdentityAdvanceAuthentication(t *testing.T) { |
| 12 | + tests := map[string]struct { |
| 13 | + username string |
| 14 | + password []byte |
| 15 | + advanceBody advanceAuthenticationRequestBody |
| 16 | + |
| 17 | + expectedError error |
| 18 | + }{ |
| 19 | + "success": { |
| 20 | + username: successUser, |
| 21 | + password: []byte(successPassword), |
| 22 | + advanceBody: advanceAuthenticationRequestBody{ |
| 23 | + Action: ActionAnswer, |
| 24 | + MechanismID: successMechanismID, |
| 25 | + SessionID: successSessionID, |
| 26 | + TenantID: "foo", |
| 27 | + PersistantLogin: true, |
| 28 | + }, |
| 29 | + |
| 30 | + expectedError: nil, |
| 31 | + }, |
| 32 | + "incorrect password": { |
| 33 | + username: successUser, |
| 34 | + password: []byte("foo"), |
| 35 | + advanceBody: advanceAuthenticationRequestBody{ |
| 36 | + Action: ActionAnswer, |
| 37 | + MechanismID: successMechanismID, |
| 38 | + SessionID: successSessionID, |
| 39 | + TenantID: "foo", |
| 40 | + PersistantLogin: true, |
| 41 | + }, |
| 42 | + |
| 43 | + expectedError: fmt.Errorf(`got a failure response from request to advance authentication: message="Authentication (login or challenge) has failed. Please try again or contact your system administrator.", error="aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee:55555555555555555555555555555555"`), |
| 44 | + }, |
| 45 | + "bad action": { |
| 46 | + username: successUser, |
| 47 | + password: []byte(successPassword), |
| 48 | + advanceBody: advanceAuthenticationRequestBody{ |
| 49 | + Action: "foo", |
| 50 | + MechanismID: successMechanismID, |
| 51 | + SessionID: successSessionID, |
| 52 | + TenantID: "foo", |
| 53 | + PersistantLogin: true, |
| 54 | + }, |
| 55 | + |
| 56 | + expectedError: fmt.Errorf(`got a failure response from request to advance authentication: message="Authentication (login or challenge) has failed. Please try again or contact your system administrator.", error="aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee:55555555555555555555555555555555"`), |
| 57 | + }, |
| 58 | + "bad mechanism id": { |
| 59 | + username: successUser, |
| 60 | + password: []byte(successPassword), |
| 61 | + advanceBody: advanceAuthenticationRequestBody{ |
| 62 | + Action: ActionAnswer, |
| 63 | + MechanismID: "foo", |
| 64 | + SessionID: successSessionID, |
| 65 | + TenantID: "foo", |
| 66 | + PersistantLogin: true, |
| 67 | + }, |
| 68 | + |
| 69 | + expectedError: fmt.Errorf(`got a failure response from request to advance authentication: message="Authentication (login or challenge) has failed. Please try again or contact your system administrator.", error="aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee:55555555555555555555555555555555"`), |
| 70 | + }, |
| 71 | + "bad session id": { |
| 72 | + username: successUser, |
| 73 | + password: []byte(successPassword), |
| 74 | + advanceBody: advanceAuthenticationRequestBody{ |
| 75 | + Action: ActionAnswer, |
| 76 | + MechanismID: successMechanismID, |
| 77 | + SessionID: "foo", |
| 78 | + TenantID: "foo", |
| 79 | + PersistantLogin: true, |
| 80 | + }, |
| 81 | + |
| 82 | + expectedError: fmt.Errorf(`got a failure response from request to advance authentication: message="Authentication (login or challenge) has failed. Please try again or contact your system administrator.", error="aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee:55555555555555555555555555555555"`), |
| 83 | + }, |
| 84 | + "persistant login not set": { |
| 85 | + username: successUser, |
| 86 | + password: []byte(successPassword), |
| 87 | + advanceBody: advanceAuthenticationRequestBody{ |
| 88 | + Action: ActionAnswer, |
| 89 | + MechanismID: successMechanismID, |
| 90 | + SessionID: successSessionID, |
| 91 | + TenantID: "foo", |
| 92 | + PersistantLogin: false, |
| 93 | + }, |
| 94 | + |
| 95 | + expectedError: fmt.Errorf("got unexpected status code 403 Forbidden from request to advance authentication in CyberArk Identity API"), |
| 96 | + }, |
| 97 | + } |
| 98 | + |
| 99 | + for name, testSpec := range tests { |
| 100 | + t.Run(name, func(t *testing.T) { |
| 101 | + ctx := context.Background() |
| 102 | + |
| 103 | + identityServer := MockIdentityServer() |
| 104 | + defer identityServer.Close() |
| 105 | + |
| 106 | + mockDiscoveryServer := servicediscovery.MockDiscoveryServerWithCustomAPIURL(identityServer.Server.URL) |
| 107 | + defer mockDiscoveryServer.Close() |
| 108 | + |
| 109 | + discoveryClient := servicediscovery.New(servicediscovery.WithCustomEndpoint(mockDiscoveryServer.Server.URL)) |
| 110 | + |
| 111 | + client, err := NewWithDiscoveryClient(ctx, discoveryClient, servicediscovery.MockDiscoverySubdomain) |
| 112 | + if err != nil { |
| 113 | + t.Errorf("failed to create identity client: %s", err) |
| 114 | + return |
| 115 | + } |
| 116 | + |
| 117 | + err = client.doAdvanceAuthentication(ctx, testSpec.username, &testSpec.password, testSpec.advanceBody) |
| 118 | + if testSpec.expectedError != err { |
| 119 | + if testSpec.expectedError == nil { |
| 120 | + t.Errorf("didn't expect an error but got %v", err) |
| 121 | + return |
| 122 | + } |
| 123 | + |
| 124 | + if err == nil { |
| 125 | + t.Errorf("expected no error but got err=%v", testSpec.expectedError) |
| 126 | + return |
| 127 | + } |
| 128 | + |
| 129 | + if err.Error() != testSpec.expectedError.Error() { |
| 130 | + t.Errorf("expected err=%v\nbut got err=%v", testSpec.expectedError, err) |
| 131 | + return |
| 132 | + } |
| 133 | + } |
| 134 | + |
| 135 | + if testSpec.expectedError != nil { |
| 136 | + return |
| 137 | + } |
| 138 | + |
| 139 | + val, ok := client.tokenCache[testSpec.username] |
| 140 | + |
| 141 | + if !ok { |
| 142 | + t.Errorf("expected token for %s to be set to %q but wasn't found", testSpec.username, mockSuccessfulStartAuthenticationToken) |
| 143 | + return |
| 144 | + } |
| 145 | + |
| 146 | + if val != mockSuccessfulStartAuthenticationToken { |
| 147 | + t.Errorf("expected token for %s to be set to %q but was set to %q", testSpec.username, mockSuccessfulStartAuthenticationToken, val) |
| 148 | + } |
| 149 | + }) |
| 150 | + } |
| 151 | +} |
0 commit comments