Skip to content

Commit 31dbdbf

Browse files
bobymicrobybobymicroby
committed
feat(auth): add EntraId integration tests
- Add integration tests for token renewal and re-authentication flows - Update credentials provider to use uniqueId as username instead of account username - Add test utilities for loading Redis endpoint configurations - Split TypeScript configs into separate files for samples and integration tests
1 parent ac972bd commit 31dbdbf

File tree

13 files changed

+285
-34
lines changed

13 files changed

+285
-34
lines changed

‎packages/authx/lib/token-manager.ts‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,6 @@ export class TokenManager<T> {
105105
*/
106106
public start(listener: TokenStreamListener<T>, initialDelayMs: number = 0): Disposable {
107107
if (this.listener) {
108-
console.log('TokenManager is already running, stopping the previous instance');
109108
this.stop();
110109
}
111110

‎packages/client/lib/client/index.ts‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -399,14 +399,12 @@ export default class RedisClient<
399399
onNext: credentials => {
400400
this.reAuthenticate(credentials).catch(error => {
401401
const errorMessage = error instanceof Error ? error.message : String(error);
402-
console.error('Error during re-authentication', errorMessage);
403402
cp.onReAuthenticationError(new CredentialsError(errorMessage));
404403
});
405404

406405
},
407406
onError: (e: Error) => {
408407
const errorMessage = `Error from streaming credentials provider: ${e.message}`;
409-
console.error(errorMessage);
410408
cp.onReAuthenticationError(new UnableToObtainNewCredentialsError(errorMessage));
411409
}
412410
});

‎packages/entraid/integration-tests/entraid-integration.spec.ts‎

Lines changed: 202 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,202 @@
1+
import { BasicAuth } from '@redis/authx';
2+
import { createClient } from '@redis/client';
3+
import { EntraIdCredentialsProviderFactory } from '../lib/entra-id-credentials-provider-factory';
4+
import { strict as assert } from 'node:assert';
5+
import { spy, SinonSpy } from 'sinon';
6+
import { randomUUID } from 'crypto';
7+
import { loadFromJson, RedisEndpointsConfig } from '@redis/test-utils/lib/cae-client-testing';
8+
import { EntraidCredentialsProvider } from '../lib/entraid-credentials-provider';
9+
10+
describe('EntraID Integration Tests', () => {
11+
12+
it('client configured with client secret should be able to authenticate/re-authenticate', async () => {
13+
const config = readConfigFromEnv();
14+
await runAuthenticationTest(() =>
15+
EntraIdCredentialsProviderFactory.createForClientCredentials({
16+
clientId: config.clientId,
17+
clientSecret: config.clientSecret,
18+
authorityConfig: { type: 'multi-tenant', tenantId: config.tenantId },
19+
tokenManagerConfig: {
20+
expirationRefreshRatio: 0.0001
21+
}
22+
})
23+
);
24+
});
25+
26+
it('client configured with client certificate should be able to authenticate/re-authenticate', async () => {
27+
const config = readConfigFromEnv();
28+
await runAuthenticationTest(() =>
29+
EntraIdCredentialsProviderFactory.createForClientCredentialsWithCertificate({
30+
clientId: config.clientId,
31+
certificate: {
32+
privateKey: config.privateKey,
33+
thumbprint: config.cert
34+
},
35+
authorityConfig: { type: 'multi-tenant', tenantId: config.tenantId },
36+
tokenManagerConfig: {
37+
expirationRefreshRatio: 0.0001
38+
}
39+
})
40+
);
41+
});
42+
43+
it('client with system managed identity should be able to authenticate/re-authenticate', async () => {
44+
const config = readConfigFromEnv();
45+
await runAuthenticationTest(() =>
46+
EntraIdCredentialsProviderFactory.createForSystemAssignedManagedIdentity({
47+
clientId: config.clientId,
48+
authorityConfig: { type: 'multi-tenant', tenantId: config.tenantId },
49+
tokenManagerConfig: {
50+
expirationRefreshRatio: 0.0001
51+
}
52+
})
53+
);
54+
});
55+
56+
it('client with user managed system identity should be able to authenticate/re-authenticate', async () => {
57+
const config = readConfigFromEnv();
58+
await runAuthenticationTest(() =>
59+
EntraIdCredentialsProviderFactory.createForUserAssignedManagedIdentity({
60+
clientId: config.clientId,
61+
userAssignedClientId : config.userAssignedManagedId,
62+
authorityConfig: { type: 'multi-tenant', tenantId: config.tenantId },
63+
tokenManagerConfig: {
64+
expirationRefreshRatio: 0.0001
65+
}
66+
})
67+
);
68+
});
69+
70+
interface TestConfig {
71+
clientId: string;
72+
clientSecret: string;
73+
authority: string;
74+
tenantId: string;
75+
redisScopes: string;
76+
cert: string;
77+
privateKey: string;
78+
userAssignedManagedId: string;
79+
endpoints: RedisEndpointsConfig;
80+
}
81+
82+
const readConfigFromEnv = (): TestConfig => {
83+
const requiredEnvVars = {
84+
AZURE_CLIENT_ID: process.env.AZURE_CLIENT_ID,
85+
AZURE_CLIENT_SECRET: process.env.AZURE_CLIENT_SECRET,
86+
AZURE_AUTHORITY: process.env.AZURE_AUTHORITY,
87+
AZURE_TENANT_ID: process.env.AZURE_TENANT_ID,
88+
AZURE_REDIS_SCOPES: process.env.AZURE_REDIS_SCOPES,
89+
AZURE_CERT: process.env.AZURE_CERT,
90+
AZURE_PRIVATE_KEY: process.env.AZURE_PRIVATE_KEY,
91+
AZURE_USER_ASSIGNED_MANAGED_ID: process.env.AZURE_USER_ASSIGNED_MANAGED_ID,
92+
REDIS_ENDPOINTS_CONFIG_PATH: process.env.REDIS_ENDPOINTS_CONFIG_PATH
93+
};
94+
95+
Object.entries(requiredEnvVars).forEach(([key, value]) => {
96+
if (value == undefined) {
97+
throw new Error(`${key} environment variable must be set`);
98+
}
99+
});
100+
101+
return {
102+
endpoints: loadFromJson(requiredEnvVars.REDIS_ENDPOINTS_CONFIG_PATH),
103+
clientId: requiredEnvVars.AZURE_CLIENT_ID,
104+
clientSecret: requiredEnvVars.AZURE_CLIENT_SECRET,
105+
authority: requiredEnvVars.AZURE_AUTHORITY,
106+
tenantId: requiredEnvVars.AZURE_TENANT_ID,
107+
redisScopes: requiredEnvVars.AZURE_REDIS_SCOPES,
108+
cert: requiredEnvVars.AZURE_CERT,
109+
privateKey: requiredEnvVars.AZURE_PRIVATE_KEY,
110+
userAssignedManagedId: requiredEnvVars.AZURE_USER_ASSIGNED_MANAGED_ID
111+
};
112+
};
113+
114+
interface TokenDetail {
115+
token: string;
116+
exp: number;
117+
iat: number;
118+
lifetime: number;
119+
uti: string;
120+
}
121+
122+
const setupTestClient = (credentialsProvider: EntraidCredentialsProvider) => {
123+
const config = readConfigFromEnv();
124+
const client = createClient({
125+
url: config.endpoints['standalone-entraid-acl'].endpoints[0],
126+
credentialsProvider
127+
});
128+
129+
const clientInstance = (client as any)._self;
130+
const reAuthSpy: SinonSpy = spy(clientInstance, 'reAuthenticate');
131+
132+
return { client, reAuthSpy };
133+
};
134+
135+
const runClientOperations = async (client: any) => {
136+
const startTime = Date.now();
137+
while (Date.now() - startTime < 1000) {
138+
const key = randomUUID();
139+
await client.set(key, 'value');
140+
const value = await client.get(key);
141+
assert.equal(value, 'value');
142+
await client.del(key);
143+
}
144+
};
145+
146+
const validateTokens = (reAuthSpy: SinonSpy) => {
147+
assert(reAuthSpy.callCount >= 1,
148+
`reAuthenticate should have been called at least once, but was called ${reAuthSpy.callCount} times`);
149+
150+
const tokenDetails: TokenDetail[] = reAuthSpy.getCalls().map(call => {
151+
const creds = call.args[0] as BasicAuth;
152+
const tokenPayload = JSON.parse(
153+
Buffer.from(creds.password.split('.')[1], 'base64').toString()
154+
);
155+
156+
return {
157+
token: creds.password,
158+
exp: tokenPayload.exp,
159+
iat: tokenPayload.iat,
160+
lifetime: tokenPayload.exp - tokenPayload.iat,
161+
uti: tokenPayload.uti
162+
};
163+
});
164+
165+
// Verify unique tokens
166+
const uniqueTokens = new Set(tokenDetails.map(detail => detail.token));
167+
assert.equal(
168+
uniqueTokens.size,
169+
reAuthSpy.callCount,
170+
`Expected ${reAuthSpy.callCount} different tokens, but got ${uniqueTokens.size} unique tokens`
171+
);
172+
173+
// Verify all tokens are not cached (i.e. have the same lifetime)
174+
const uniqueLifetimes = new Set(tokenDetails.map(detail => detail.lifetime));
175+
assert.equal(
176+
uniqueLifetimes.size,
177+
1,
178+
`Expected all tokens to have the same lifetime, but found ${uniqueLifetimes.size} different lifetimes: ${[uniqueLifetimes].join(', ')} seconds`
179+
);
180+
181+
// Verify that all tokens have different uti (unique token identifier)
182+
const uniqueUti = new Set(tokenDetails.map(detail => detail.uti));
183+
assert.equal(
184+
uniqueUti.size,
185+
reAuthSpy.callCount,
186+
`Expected all tokens to have different uti, but found ${uniqueUti.size} different uti in: ${[uniqueUti].join(', ')}`
187+
);
188+
};
189+
190+
const runAuthenticationTest = async (setupCredentialsProvider: () => any) => {
191+
const { client, reAuthSpy } = setupTestClient(setupCredentialsProvider());
192+
193+
try {
194+
await client.connect();
195+
await runClientOperations(client);
196+
validateTokens(reAuthSpy);
197+
} finally {
198+
await client.destroy();
199+
}
200+
};
201+
202+
});

‎packages/entraid/lib/entra-id-credentials-provider-factory.ts‎

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -72,9 +72,9 @@ export class EntraIdCredentialsProviderFactory {
7272
* @param params
7373
*/
7474
static createForUserAssignedManagedIdentity(
75-
params: CredentialParams
75+
params: CredentialParams & { userAssignedClientId: string }
7676
): EntraidCredentialsProvider {
77-
return this.createManagedIdentityProvider(params, params.clientId);
77+
return this.createManagedIdentityProvider(params, params.userAssignedClientId);
7878
}
7979

8080
private static _createForClientCredentials(
@@ -101,7 +101,22 @@ export class EntraIdCredentialsProviderFactory {
101101
);
102102

103103
return new EntraidCredentialsProvider(new TokenManager(idp, params.tokenManagerConfig), idp,
104-
{ onReAuthenticationError: params.onReAuthenticationError });
104+
{
105+
onReAuthenticationError: params.onReAuthenticationError,
106+
credentialsMapper: (token) => {
107+
108+
// Client credentials flow is app-only authentication (no user context),
109+
// so only access token is provided without user-specific claims (uniqueId, idToken, ...)
110+
// this means that we need to extract the oid from the access token manually
111+
const accessToken = JSON.parse(Buffer.from(token.accessToken.split('.')[1], 'base64').toString());
112+
113+
return ({
114+
username: accessToken.oid,
115+
password: token.accessToken
116+
})
117+
118+
}
119+
});
105120
}
106121

107122
/**
@@ -257,7 +272,7 @@ const loggerOptions = {
257272
if (!containsPii) console.log(message);
258273
},
259274
piiLoggingEnabled: false,
260-
logLevel: LogLevel.Verbose
275+
logLevel: LogLevel.Error
261276
}
262277

263278
/**

‎packages/entraid/lib/entraid-credentials-provider.spec.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -134,15 +134,15 @@ describe('EntraID CredentialsProvider Subscription Behavior', () => {
134134
private readonly tokenSequence: AuthenticationResult[] = [
135135
{
136136
accessToken: 'initial-token',
137-
account: { username: 'test-user' }
137+
uniqueId: 'test-user'
138138
} as AuthenticationResult,
139139
{
140140
accessToken: 'refresh-token-1',
141-
account: { username: 'test-user' }
141+
uniqueId: 'test-user'
142142
} as AuthenticationResult,
143143
{
144144
accessToken: 'refresh-token-2',
145-
account: { username: 'test-user' }
145+
uniqueId: 'test-user'
146146
} as AuthenticationResult
147147
]
148148
) {}

‎packages/entraid/lib/entraid-credentials-provider.ts‎

Lines changed: 22 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -24,20 +24,16 @@ export class EntraidCredentialsProvider implements StreamingCredentialsProvider
2424
}> = [];
2525

2626
constructor(
27-
private readonly tokenManager: TokenManager<AuthenticationResult>,
28-
private readonly idp: IdentityProvider<AuthenticationResult>,
29-
options: {
30-
onReAuthenticationError?: (error: ReAuthenticationError) => void
31-
credentialsMapper?: (token: AuthenticationResult) => BasicAuth
27+
public readonly tokenManager: TokenManager<AuthenticationResult>,
28+
public readonly idp: IdentityProvider<AuthenticationResult>,
29+
private readonly options: {
30+
onReAuthenticationError?: (error: ReAuthenticationError) => void;
31+
credentialsMapper?: (token: AuthenticationResult) => BasicAuth;
32+
onTransientError?: (error: string) => void;
3233
} = {}
3334
) {
34-
this.onReAuthenticationError = options.onReAuthenticationError ??
35-
((error) => console.error('ReAuthenticationError', error));
36-
this.credentialsMapper = options.credentialsMapper ?? ((token) => ({
37-
username: token.account?.username ?? undefined,
38-
password: token.accessToken
39-
}));
40-
35+
this.onReAuthenticationError = options.onReAuthenticationError ?? DEFAULT_ERROR_HANDLER;
36+
this.credentialsMapper = options.credentialsMapper ?? DEFAULT_CREDENTIALS_MAPPER;
4137
}
4238

4339
async subscribe(
@@ -81,7 +77,7 @@ export class EntraidCredentialsProvider implements StreamingCredentialsProvider
8177
if (error.isFatal) {
8278
subscribers.forEach(listener => listener.onError(error));
8379
} else {
84-
console.log('Transient identity provider error', error);
80+
this.options.onTransientError?.(error.message);
8581
}
8682
},
8783
onNext: (token: { value: AuthenticationResult }): void => {
@@ -124,4 +120,16 @@ export class EntraidCredentialsProvider implements StreamingCredentialsProvider
124120
return this.listeners.size;
125121
}
126122

127-
}
123+
public getTokenManager() {
124+
return this.tokenManager;
125+
}
126+
127+
}
128+
129+
const DEFAULT_CREDENTIALS_MAPPER = (token: AuthenticationResult): BasicAuth => ({
130+
username: token.uniqueId,
131+
password: token.accessToken
132+
});
133+
134+
const DEFAULT_ERROR_HANDLER = (error: ReAuthenticationError) =>
135+
console.error('ReAuthenticationError', error);

‎packages/entraid/lib/msal-identity-provider.ts‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ export class MSALIdentityProvider implements IdentityProvider<AuthenticationResu
2222
ttlMs: result.expiresOn.getTime() - Date.now()
2323
};
2424
} catch (error) {
25-
console.error('Error acquiring token:', error);
2625
throw error;
2726
}
2827
}

‎packages/entraid/package.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,8 @@
1111
"scripts": {
1212
"clean": "rimraf dist",
1313
"build": "npm run clean && tsc",
14-
"start:auth-pkce": "npm run build && node dist/samples/auth-code-pkce/index.js",
14+
"start:auth-pkce": "tsx --tsconfig tsconfig.samples.json ./samples/auth-code-pkce/index.ts",
15+
"test-integration": "mocha -r tsx --tsconfig tsconfig.integration-tests.json './integration-tests/**/*.spec.ts'",
1516
"test": "nyc -r text-summary -r lcov mocha -r tsx './lib/**/*.spec.ts'"
1617
},
1718
"dependencies": {

‎packages/entraid/samples/auth-code-pkce/index.ts‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -82,10 +82,6 @@ app.get('/login', async (req: AuthRequest, res: Response) => {
8282

8383
app.get('/redirect', async (req: AuthRequest, res: Response) => {
8484
try {
85-
// Debug log to see exactly what we're receiving
86-
console.log('Full request query:', req.query);
87-
console.log('Code from request:', req.query.code);
88-
console.log('Session state:', req.session);
8985

9086
// The authorization code is in req.query.code
9187
const { code, client_info } = req.query;

‎packages/entraid/tsconfig.integration-tests.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{
2+
"extends": "./tsconfig.json",
3+
"include": [
4+
"./integration-tests/**/*.ts",
5+
"./lib/**/*.ts"
6+
],
7+
"compilerOptions": {
8+
"noEmit": true
9+
},
10+
}

0 commit comments

Comments
 (0)