Merge pull request #19 from sambott/www-authenticate

www-authenticate response

Author: sambott

Gopkg.lock

@@ -2,17 +2,13 @@
   name = "github.com/fatih/structs"
   version = "1.0.0"
 
-[[constraint]]
-  name = "github.com/go-ldap/ldap"
-  revision = "0776dae456c9f852c74287dfa8475c16401ac9a9"
-
 [[constraint]]
   branch = "master"
   name = "github.com/hashicorp/go-multierror"
 
 [[constraint]]
   name = "github.com/hashicorp/vault"
-  version = "0.10.0"
+  version = "1.1.1"
 
 [prune]
   go-tests = true

Gopkg.toml

@@ -30,8 +30,8 @@ func pathConfig(b *backend) *framework.Path {
 			},
 		},
 		Callbacks: map[logical.Operation]framework.OperationFunc{
-			logical.CreateOperation: b.pathConfigWrite,
 			logical.UpdateOperation: b.pathConfigWrite,
+			logical.CreateOperation: b.pathConfigWrite,
 			logical.ReadOperation:   b.pathConfigRead,
 		},
 

path_config.go

@@ -41,7 +41,7 @@ func TestConfig_ReadWrite(t *testing.T) {
 	}
 
 	req := &logical.Request{
-		Operation: logical.CreateOperation,
+		Operation: logical.UpdateOperation,
 		Path:      configPath,
 		Storage:   storage,
 		Data:      data,
@@ -95,7 +95,7 @@ func TestConfig_RejectsBadWrites(t *testing.T) {
 func testConfigWriteError(t *testing.T, b logical.Backend, storage logical.Storage,
 	data map[string]interface{}, e string) {
 	req := &logical.Request{
-		Operation: logical.CreateOperation,
+		Operation: logical.UpdateOperation,
 		Path:      configPath,
 		Storage:   storage,
 		Data:      data,

path_config_test.go

@@ -27,6 +27,7 @@ func pathLogin(b *backend) *framework.Path {
 			},
 		},
 		Callbacks: map[logical.Operation]framework.OperationFunc{
+			logical.ReadOperation:   b.pathLoginGet,
 			logical.UpdateOperation: b.pathLogin,
 		},
 	}
@@ -67,6 +68,15 @@ func spnegoKrb5Authenticate(kt keytab.Keytab, sa string, authorization []byte, r
 	return ok, &creds, err
 }
 
+func (b *backend) pathLoginGet(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
+	return &logical.Response{
+		Auth: &logical.Auth{},
+		Headers: map[string][]string{
+			"www-authenticate": {"Negotiate"},
+		},
+	}, logical.CodedError(401, "authentication required")
+}
+
 func (b *backend) pathLogin(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
 	config, err := b.config(ctx, req.Storage)
 	if err != nil {
@@ -110,7 +120,7 @@ func (b *backend) pathLogin(ctx context.Context, req *logical.Request, d *framew
 
 	s := strings.SplitN(authorizationString, " ", 2)
 	if len(s) != 2 || s[0] != "Negotiate" {
-		return logical.ErrorResponse("Missing or invalid authorization"), nil
+		return b.pathLoginGet(ctx, req, d)
 	}
 	authorization, err := base64.StdEncoding.DecodeString(s[1])
 	if err != nil {

path_login.go

@@ -20,7 +20,7 @@ func setupTestBackend(t *testing.T) (logical.Backend, logical.Storage) {
 	}
 
 	req := &logical.Request{
-		Operation: logical.CreateOperation,
+		Operation: logical.UpdateOperation,
 		Path:      configPath,
 		Storage:   storage,
 		Data:      data,
@@ -66,11 +66,20 @@ func TestLogin(t *testing.T) {
 	}
 
 	resp, err = b.HandleRequest(context.Background(), req)
-	if err != nil || resp == nil {
+	if err == nil || resp == nil || resp.IsError() {
 		t.Fatalf("err: %s resp: %#v\n", err, resp)
 	}
-	if !resp.IsError() && !strings.HasPrefix(resp.Error().Error(), "Missing or invalid authorization") {
-		t.Fatalf("err: %s resp: %#v\n", err, resp)
+
+	if e, ok := err.(logical.HTTPCodedError); !ok || e.Code() != 401 {
+		t.Fatalf("no 401 thrown. err: %s resp: %#v\n", err, resp)
+	}
+
+	if headerVal, ok := resp.Headers["www-authenticate"]; ok {
+		if strings.Compare(headerVal[0], "Negotiate") != 0 {
+			t.Fatalf("www-authenticate not set to Negotiate. err: %s resp: %#v\n", err, resp)
+		}
+	} else {
+		t.Fatalf("no www-authenticate header. err: %s resp: %#v\n", err, resp)
 	}
 }