Skip to content

Commit a691477

Browse files
michaelklishinmichaelklishin
committed
Redirect to end_session_endpoint for idp-initiated logon
Conflicts: selenium/bin/components/fakeportal (cherry picked from commit ab8799a)
1 parent 0b8fb95 commit a691477

26 files changed

+223
-60
lines changed

‎deps/rabbitmq_management/priv/www/js/oidc-oauth/helper.js‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -154,9 +154,9 @@ export function oidc_settings_from(resource_server) {
154154
automaticSilentRenew: true,
155155
revokeAccessTokenOnSignout: true
156156
}
157-
if (resource_server.end_session_endpoint != "") {
157+
if (resource_server.oauth_end_session_endpoint != "") {
158158
oidcSettings.metadataSeed = {
159-
end_session_endpoint: resource_server.end_session_endpoint
159+
end_session_endpoint: resource_server.oauth_end_session_endpoint
160160
}
161161
}
162162
if (resource_server.oauth_client_secret != "") {
@@ -214,6 +214,9 @@ export function oauth_initialize(authSettings) {
214214
if (resource_server) {
215215
oauth.sp_initiated = resource_server.sp_initiated
216216
oauth.authority = resource_server.oauth_provider_url
217+
if (resource_server.oauth_end_session_endpoint != "") {
218+
oauth.oauth_end_session_endpoint = resource_server.oauth_end_session_endpoint
219+
}
217220
if (!resource_server.sp_initiated) return oauth;
218221
else oauth_initialize_user_manager(resource_server)
219222
}
@@ -311,7 +314,11 @@ export function oauth_initiateLogout() {
311314
})
312315

313316
} else {
314-
go_to_authority()
317+
if (oauth.oauth_end_session_endpoint != null) {
318+
location.href = oauth.oauth_end_session_endpoint
319+
}else {
320+
go_to_authority()
321+
}
315322
}
316323
}
317324

‎deps/rabbitmq_management/src/rabbit_mgmt_wm_auth.erl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ oauth_provider_to_map(OAuthProvider) ->
7272
end,
7373
case OAuthProvider#oauth_provider.end_session_endpoint of
7474
undefined -> Map0;
75-
V -> maps:put(end_session_endpoint, V, Map0)
75+
V -> maps:put(oauth_end_session_endpoint, V, Map0)
7676
end.
7777

7878
skip_unknown_mgt_resource_servers(ManagementProps, OAuth2Resources) ->

‎deps/rabbitmq_management/test/rabbit_mgmt_wm_auth_SUITE.erl‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -788,31 +788,31 @@ should_return_oauth_client_id_z(Config) ->
788788

789789
should_not_return_end_session_endpoint(Config) ->
790790
assert_attribute_not_defined_for_oauth_resource_server(authSettings(),
791-
Config, rabbit, end_session_endpoint).
791+
Config, rabbit, oauth_end_session_endpoint).
792792

793793
should_return_end_session_endpoint_0(Config) ->
794794
assertEqual_on_attribute_for_oauth_resource_server(authSettings(),
795-
Config, rabbit, end_session_endpoint, ?config(logout_url_0, Config)).
795+
Config, rabbit, oauth_end_session_endpoint, ?config(logout_url_0, Config)).
796796

797797
should_return_end_session_endpoint_1(Config) ->
798798
assertEqual_on_attribute_for_oauth_resource_server(authSettings(),
799-
Config, rabbit, end_session_endpoint, ?config(logout_url_1, Config)).
799+
Config, rabbit, oauth_end_session_endpoint, ?config(logout_url_1, Config)).
800800

801801
should_return_oauth_resource_server_a_without_end_session_endpoint(Config) ->
802802
assert_attribute_not_defined_for_oauth_resource_server(authSettings(),
803-
Config, a, end_session_endpoint).
803+
Config, a, oauth_end_session_endpoint).
804804

805805
should_return_oauth_resource_server_a_with_end_session_endpoint_0(Config) ->
806806
assertEqual_on_attribute_for_oauth_resource_server(authSettings(),
807-
Config, a, end_session_endpoint, ?config(logout_url_0, Config)).
807+
Config, a, oauth_end_session_endpoint, ?config(logout_url_0, Config)).
808808

809809
should_return_oauth_resource_server_a_with_end_session_endpoint_1(Config) ->
810810
assertEqual_on_attribute_for_oauth_resource_server(authSettings(),
811-
Config, a, end_session_endpoint, ?config(logout_url_1, Config)).
811+
Config, a, oauth_end_session_endpoint, ?config(logout_url_1, Config)).
812812

813813
should_return_oauth_resource_server_a_with_end_session_endpoint_2(Config) ->
814814
assertEqual_on_attribute_for_oauth_resource_server(authSettings(),
815-
Config, a, end_session_endpoint, ?config(logout_url_2, Config)).
815+
Config, a, oauth_end_session_endpoint, ?config(logout_url_2, Config)).
816816

817817
should_return_mgt_oauth_resource_rabbit_without_authorization_endpoint_params(Config) ->
818818
assert_attribute_not_defined_for_oauth_resource_server(authSettings(),

‎selenium/bin/components/fakeportal‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,10 @@ ensure_fakeportal() {
1515
}
1616

1717
init_fakeportal() {
18-
FAKEPORTAL_URL=${FAKEPORTAL_URL:-http://fakeportal:3000}
18+
FAKEPORTAL_URL=${FAKEPORTAL_URL:-https://fakeportal:3000}
19+
FAKEPORTAL_CONFIG_PATH=${FAKEPORTAL_CONFIG_PATH:-oauth/fakeportal}
20+
FAKEPORTAL_CONFIG_DIR=$(realpath ${TEST_DIR}/${FAKEPORTAL_CONFIG_PATH})
21+
1922
FAKEPORTAL_DIR=${SCRIPT}/../../fakeportal
2023
CLIENT_ID="${CLIENT_ID:-rabbit_idp_user}"
2124
CLIENT_SECRET="${CLIENT_SECRET:-rabbit_idp_user}"
@@ -32,6 +35,9 @@ init_fakeportal() {
3235
print "> CLIENT_ID: ${CLIENT_ID}"
3336
print "> CLIENT_SECRET: ${CLIENT_SECRET}"
3437
print "> RABBITMQ_URL: ${RABBITMQ_URL}"
38+
39+
generate-ca-server-client-kpi fakeportal $FAKEPORTAL_CONFIG_DIR
40+
3541
}
3642
start_fakeportal() {
3743
begin "Starting fakeportal ..."
@@ -40,6 +46,10 @@ start_fakeportal() {
4046
kill_container_if_exist fakeportal
4147
mocha_test_tag=($(md5sum $SELENIUM_ROOT_FOLDER/package.json))
4248

49+
MOUNT_FAKEPORTAL_CONF_DIR=$CONF_DIR/fakeportal
50+
mkdir -p $MOUNT_FAKEPORTAL_CONF_DIR
51+
cp ${FAKEPORTAL_CONFIG_DIR}/*.pem $MOUNT_FAKEPORTAL_CONF_DIR
52+
4353
docker run \
4454
--detach \
4555
--name fakeportal \
@@ -52,7 +62,8 @@ start_fakeportal() {
5262
--env CLIENT_ID="${CLIENT_ID}" \
5363
--env CLIENT_SECRET="${CLIENT_SECRET}" \
5464
--env NODE_EXTRA_CA_CERTS=/etc/uaa/ca_uaa_certificate.pem \
55-
-v ${TEST_CONFIG_DIR}/uaa:/etc/uaa \
65+
-v ${TEST_CONFIG_PATH}/uaa:/etc/uaa \
66+
-v ${MOUNT_FAKEPORTAL_CONF_DIR}:/etc/fakeportal \
5667
-v ${FAKEPORTAL_DIR}:/code/fakeportal \
5768
mocha-test:${mocha_test_tag} run fakeportal
5869

‎selenium/bin/suite_template‎

Lines changed: 63 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ tabs 1
1313
declare -i PADDING_LEVEL=0
1414
declare -i STEP=1
1515
declare -a REQUIRED_COMPONENTS
16+
declare -a INIT_ONLY_COMPONENTS
1617

1718
find_selenium_dir() {
1819
TEST_PATH=$1
@@ -112,6 +113,7 @@ init_suite() {
112113

113114
begin "Initializing suite $SUITE ..."
114115
print "> REQUIRED_COMPONENTS: ${REQUIRED_COMPONENTS[*]}"
116+
print "> INIT_ONLY_COMPONENTS: ${INIT_ONLY_COMPONENTS[*]}"
115117
print "> TEST_CASES_DIR: ${TEST_CASES_DIR} "
116118
print "> TEST_CONFIG_DIR: ${TEST_CONFIG_DIR} "
117119
print "> DOCKER_NETWORK: ${DOCKER_NETWORK} "
@@ -218,20 +220,37 @@ wait_for_oidc_endpoint_docker() {
218220
calculate_rabbitmq_url() {
219221
echo "${RABBITMQ_SCHEME:-http}://$1${PUBLIC_RABBITMQ_PATH:-$RABBITMQ_PATH}"
220222
}
221-
223+
calculate_forward_proxy_url() {
224+
PROXIED_URL=$1
225+
PROXY_HOSTNAME=$2
226+
PROXY_PORT=$3
227+
SCHEME=$(echo "$PROXIED_URL" | cut -d: -f1)
228+
PATH=$(echo "$PROXIED_URL" | cut -d/ -f4-)
229+
echo "$SCHEME://$PROXY_HOSTNAME:$PROXY_PORT/$PATH"
230+
}
222231
wait_for_url() {
223-
BASE_URL=$1
232+
BASE_URL=$1
224233
if [[ $BASE_URL == *"localhost"** ]]; then
225-
wait_for_url_local $BASE_URL
234+
wait_for_url_local $@
226235
else
227-
wait_for_url_docker $BASE_URL
236+
wait_for_url_docker $@
228237
fi
229238
}
230239
wait_for_url_local() {
231240
url=$1
241+
proxy=${2:-none}
242+
proxy_user=${3:-none}
243+
proxy_pass=$4
244+
curl_args="-L -f -v"
232245
max_retry=10
233246
counter=0
234-
until (curl -L -f -v $url >/dev/null 2>&1)
247+
if [[ "$proxy" != "none" && "$proxy" != "" ]]; then
248+
curl_args="--proxy ${proxy} ${curl_args}"
249+
fi
250+
if [[ "$proxy_user" != "none" && "$proxy_user" != "" ]]; then
251+
curl_args="--proxy-user ${proxy_user}:${proxy_pass} ${curl_args}"
252+
fi
253+
until (curl $curl_args $url >/dev/null 2>&1)
235254
do
236255
print "Waiting for $url to start (local)"
237256
sleep 5
@@ -244,7 +263,14 @@ wait_for_url_docker() {
244263
url=$1
245264
max_retry=10
246265
counter=0
247-
until (docker run --net ${DOCKER_NETWORK} --rm curlimages/curl:7.85.0 -L -f -v $url >/dev/null 2>&1)
266+
curl_args="-L -f -v"
267+
if [[ "$proxy" != "none" && "$proxy" != "" ]]; then
268+
curl_args="--proxy ${proxy} ${curl_args}"
269+
fi
270+
if [[ "$proxy_user" != "none" && "$proxy_user" != "" ]]; then
271+
curl_args="--proxy-user ${proxy_user}:${proxy_pass} ${curl_args}"
272+
fi
273+
until (docker run --net ${DOCKER_NETWORK} --rm curlimages/curl:7.85.0 $curl_args $url >/dev/null 2>&1)
248274
do
249275
print "Waiting for $url to start (docker)"
250276
sleep 5
@@ -377,7 +403,8 @@ profiles_with_local_or_docker() {
377403
generate_env_file() {
378404
begin "Generating env file ..."
379405
mkdir -p $CONF_DIR
380-
${BIN_DIR}/gen-env-file $TEST_CONFIG_DIR $ENV_FILE
406+
${BIN_DIR}/gen-env-file $TEST_CONFIG_DIR ${ENV_FILE}.tmp
407+
grep -v '^#' ${ENV_FILE}.tmp > $ENV_FILE
381408
source $ENV_FILE
382409
end "Finished generating env file."
383410
}
@@ -475,6 +502,9 @@ generate-client-keystore-if-required() {
475502
fi
476503
}
477504

505+
initOnly() {
506+
determine_init_only_components $@
507+
}
478508
run() {
479509
runWith rabbitmq
480510
}
@@ -525,6 +555,12 @@ elif [[ "$COMMAND" == "stop-rabbitmq" ]]
525555
test_local ${BASH_REMATCH[1]}
526556
fi
527557
}
558+
determine_init_only_components() {
559+
for (( i=1; i<=$#; i++)) {
560+
eval val='$'$i
561+
INIT_ONLY_COMPONENTS+=( "$val" )
562+
}
563+
}
528564
determine_required_components_including_rabbitmq() {
529565
for (( i=1; i<=$#; i++)) {
530566
eval val='$'$i
@@ -560,7 +596,7 @@ run_on_docker_with() {
560596
build_mocha_image
561597
start_selenium
562598

563-
trap teardown_components EXIT
599+
trap "teardown_components" EXIT
564600

565601
start_components
566602
test
@@ -637,11 +673,27 @@ ensure_components() {
637673
start_components() {
638674
for i in "${REQUIRED_COMPONENTS[@]}"
639675
do
640-
start="start_$i"
641-
$start
676+
local ret=$(is_init_only_component $i)
677+
if [[ $ret == 1 ]]
678+
then
679+
init="init_$i"
680+
$init
681+
else
682+
start="start_$i"
683+
$start
684+
fi
642685
done
643686
}
644-
687+
is_init_only_component() {
688+
for i in "${INIT_ONLY_COMPONENTS[@]}"
689+
do
690+
if [[ $i == $1 ]]
691+
then
692+
return 1
693+
fi
694+
done
695+
return 0
696+
}
645697
teardown_components() {
646698
skip_rabbitmq=${1:-false}
647699

‎selenium/fakeportal/app.js‎

Lines changed: 31 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
const express = require("express");
22
const app = express();
3+
const fs = require('fs');
4+
const https = require('https');
35
var path = require('path');
46
const XMLHttpRequest = require('xmlhttprequest').XMLHttpRequest
57

@@ -15,19 +17,38 @@ app.set('views', path.join(__dirname, 'views'));
1517
app.set('view engine', 'html');
1618

1719
app.get('/', function(req, res){
18-
let id = default_if_blank(req.query.client_id, client_id);
19-
let secret = default_if_blank(req.query.client_secret, client_secret);
20-
res.render('rabbitmq', {
21-
proxied_url: proxied_rabbitmq_url,
22-
url: rabbitmq_url.replace(/\/?$/, '/') + "login",
23-
name: rabbitmq_url + " for " + id,
24-
access_token: access_token(id, secret)
25-
});
26-
});
20+
let id = default_if_blank(req.query.client_id, client_id)
21+
let secret = default_if_blank(req.query.client_secret, client_secret)
22+
if (id == 'undefined' || secret == 'undefined') {
23+
res.render('unauthenticated')
24+
}else {
25+
res.render('rabbitmq', {
26+
proxied_url: proxied_rabbitmq_url,
27+
url: rabbitmq_url.replace(/\/?$/, '/') + "login",
28+
name: rabbitmq_url + " for " + id,
29+
access_token: access_token(id, secret)
30+
})
31+
}
32+
})
33+
2734
app.get('/favicon.ico', (req, res) => res.status(204));
2835

36+
app.get('/logout', function(req, res) {
37+
const redirectUrl = uaa_url + '/logout.do?client_id=' + client_id + "&redirect=https://fakeportal:3000"
38+
console.debug("Received /logout request -> redirect to " + redirectUrl)
39+
res.redirect(redirectUrl);
40+
})
41+
42+
https
43+
.createServer(
44+
{
45+
cert: fs.readFileSync('/etc/fakeportal/server_fakeportal_certificate.pem'),
46+
key: fs.readFileSync('/etc/fakeportal/server_fakeportal_key.pem')
47+
},
48+
app
49+
)
50+
.listen(port)
2951

30-
app.listen(port);
3152
console.log('Express started on port ' + port);
3253

3354
function default_if_blank(value, defaultValue) {

‎selenium/fakeportal/views/unauthenticated.html‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
<h1> FakePortal </h1>
2+
3+
<p>This is a portal used to test <b>Identity-Provider-based authentication</b>.
4+
This means users comes to RabbitMQ with a token already obtained without involving RabbitMQ
5+
management ui.
6+
</p>
7+
8+
<p>This is the state of the Portal when the user is not authenticated yet.</p>
9+
<p>To get the fakeportal fully authenticated, pass two request parameters:
10+
<ul>
11+
<li>client_id</li>
12+
<li>client_secret</li>
13+
</ul>
14+
These credentitals are used to get an access token from UAA and send it to
15+
RabbitMQ.
16+
</p>
17+
18+

‎selenium/suites/authnz-mgt/oauth-idp-initiated-with-uaa-and-prefix-via-proxy.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
44

55
TEST_CASES_PATH=/oauth/with-idp-initiated-via-proxy
66
TEST_CONFIG_PATH=/oauth
7-
PROFILES="uaa fakeportal fakeproxy fakeportal-mgt-oauth-provider idp-initiated mgt-prefix uaa-oauth-provider"
7+
PROFILES="uaa fakeportal fakeproxy fakeportal-mgt-oauth-provider idp-initiated mgt-prefix uaa-oauth-provider tls"
88

99
source $SCRIPT/../../bin/suite_template $@
1010
runWith rabbitmq uaa fakeportal fakeproxy

‎selenium/suites/authnz-mgt/oauth-idp-initiated-with-uaa-and-prefix.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
44

55
TEST_CASES_PATH=/oauth/with-idp-initiated
66
TEST_CONFIG_PATH=/oauth
7-
PROFILES="uaa fakeportal-mgt-oauth-provider idp-initiated mgt-prefix uaa-oauth-provider"
7+
PROFILES="uaa fakeportal-mgt-oauth-provider idp-initiated mgt-prefix uaa-oauth-provider tls"
88

99
source $SCRIPT/../../bin/suite_template $@
1010
runWith uaa fakeportal

‎selenium/suites/authnz-mgt/oauth-idp-initiated-with-uaa-via-proxy.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
44

55
TEST_CASES_PATH=/oauth/with-idp-initiated-via-proxy
66
TEST_CONFIG_PATH=/oauth
7-
PROFILES="uaa fakeportal fakeproxy fakeportal-mgt-oauth-provider idp-initiated uaa-oauth-provider"
7+
PROFILES="uaa fakeportal fakeproxy fakeportal-mgt-oauth-provider idp-initiated uaa-oauth-provider tls"
88

99
source $SCRIPT/../../bin/suite_template $@
1010
runWith rabbitmq uaa fakeportal fakeproxy

0 commit comments

Comments
 (0)