djpbessems/ContainerImage.Pinniped
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Clarify godoc for AdditionalClaimMappings to indicate that missing upstream claims will not show up in the downstream token

Browse Source
This commit is contained in:
Joshua Casey 2023-01-11 12:55:37 -06:00
parent 7b01c3ce18
commit d7b5f4d4ea
2 changed files with 31 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
generated/latest/apis/supervisor/idp/v1alpha1/types_oidcidentityprovider.go generated
View File

@ -143,10 +143,10 @@ type OIDCClaims struct {
// "additionalClaims" claim of the ID tokens generated by the Supervisor. This should be specified as a map of
// new claim names as the keys, and upstream claim names as the values. These new claim names will be nested
// under the top-level "additionalClaims" claim in ID tokens generated by the Supervisor when this
// OIDCIdentityProvider was used for user authentication. This feature is not required for using the Supervisor to
// OIDCIdentityProvider was used for user authentication. This feature is not required to use the Supervisor to
// provide authentication for Kubernetes clusters, but can be used when using the Supervisor for other
// authentication purposes. When this map is empty, the "additionalClaims" claim will be excluded from the ID
// tokens generated by the Supervisor.
// authentication purposes. When this map is empty or the upstream claims are not available, the "additionalClaims"
// claim will be excluded from the ID tokens generated by the Supervisor.
// +optional
AdditionalClaimMappings map[string]string `json:"additionalClaimMappings"`
}

28
internal/oidc/auth/auth_handler_test.go
View File

@ -746,6 +746,34 @@ func TestAuthorizationEndpoint(t *testing.T) {
"downstreamOtherClaim": "other claim value",
},
},
{
name: "OIDC upstream password grant happy path using GET with additional claim mappings, when upstream claims are not available",
idps: oidctestutil.NewUpstreamIDPListerBuilder().WithOIDC(passwordGrantUpstreamOIDCIdentityProviderBuilder().
WithAdditionalClaimMappings(map[string]string{
"downstream": "upstream",
}).
WithIDTokenClaim("not-upstream", "value").
Build()),
method: http.MethodGet,
path: happyGetRequestPath,
customUsernameHeader: pointer.String(oidcUpstreamUsername),
customPasswordHeader: pointer.String(oidcUpstreamPassword),
wantPasswordGrantCall: happyUpstreamPasswordGrantMockExpectation,
wantStatus: http.StatusFound,
wantContentType: htmlContentType,
wantRedirectLocationRegexp: happyAuthcodeDownstreamRedirectLocationRegexp,
wantDownstreamIDTokenSubject: oidcUpstreamIssuer + "?sub=" + oidcUpstreamSubjectQueryEscaped,
wantDownstreamIDTokenUsername: oidcUpstreamUsername,
wantDownstreamIDTokenGroups: oidcUpstreamGroupMembership,
wantDownstreamRequestedScopes: happyDownstreamScopesRequested,
wantDownstreamRedirectURI: downstreamRedirectURI,
wantDownstreamGrantedScopes: happyDownstreamScopesGranted,
wantDownstreamNonce: downstreamNonce,
wantDownstreamPKCEChallenge: downstreamPKCEChallenge,
wantDownstreamPKCEChallengeMethod: downstreamPKCEChallengeMethod,
wantDownstreamCustomSessionData: expectedHappyOIDCPasswordGrantCustomSession,
wantAdditionalClaims: nil, // downstream claims are empty
},
{
name: "LDAP cli upstream happy path using GET",
idps: oidctestutil.NewUpstreamIDPListerBuilder().WithLDAP(&upstreamLDAPIdentityProvider),