Skip to content

Commit 858dd7e

Browse files
eguzkieguzki
committed
t/apicast-policy-token-introspection.t: e2e tests
1 parent 2cee996 commit 858dd7e

File tree

1 file changed

+181
-7
lines changed

1 file changed

+181
-7
lines changed

‎t/apicast-policy-token-introspection.t

+181-7
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ Token introspection policy check access token.
3030
"proxy": {
3131
"policy_chain": [
3232
{
33-
"name": "apicast.policy.token_introspection",
33+
"name": "apicast.policy.token_introspection",
3434
"configuration": {
3535
"auth_type": "client_id+client_secret",
3636
"client_id": "app",
@@ -80,7 +80,7 @@ Token introspection policy return "403 Unauthorized" if access token is already
8080
"proxy": {
8181
"policy_chain": [
8282
{
83-
"name": "apicast.policy.token_introspection",
83+
"name": "apicast.policy.token_introspection",
8484
"configuration": {
8585
"auth_type": "client_id+client_secret",
8686
"client_id": "app",
@@ -133,7 +133,7 @@ Token introspection policy return "403 Unauthorized" if IdP response error statu
133133
"proxy": {
134134
"policy_chain": [
135135
{
136-
"name": "apicast.policy.token_introspection",
136+
"name": "apicast.policy.token_introspection",
137137
"configuration": {
138138
"auth_type": "client_id+client_secret",
139139
"client_id": "app",
@@ -164,6 +164,7 @@ Authorization: Bearer testaccesstoken
164164
--- error_code: 403
165165
--- no_error_log
166166
[error]
167+
167168
=== TEST 4: Token introspection request is failed with bad response value
168169
Token introspection policy return "403 Unauthorized" if IdP response invalid contents type.
169170
--- backend
@@ -271,7 +272,7 @@ Authorization: Bearer testaccesstoken
271272
[error]
272273

273274
=== TEST 6: Token introspection request success with oidc issuer endpoint
274-
Token introspection policy retrieves client_id and client_secret and
275+
Token introspection policy retrieves client_id and client_secret and
275276
introspection endpoint from the oidc_issuer_endpoint of the service configuration.
276277
--- backend
277278
location /token/introspection {
@@ -293,7 +294,10 @@ introspection endpoint from the oidc_issuer_endpoint of the service configuratio
293294
"oidc": [
294295
{
295296
"issuer": "https://example.com/auth/realms/apicast",
296-
"config": { "id_token_signing_alg_values_supported": [ "RS256" ] },
297+
"config": {
298+
"id_token_signing_alg_values_supported": [ "RS256" ],
299+
"introspection_endpoint": "http://test_backend:$TEST_NGINX_SERVER_PORT/token/introspection"
300+
},
297301
"keys": { "somekid": { "pem": "-----BEGIN PUBLIC KEY-----\nMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALClz96cDQ965ENYMfZzG+Acu25lpx2K\nNpAALBQ+catCA59us7+uLY5rjQR6SOgZpCz5PJiKNAdRPDJMXSmXqM0CAwEAAQ==\n-----END PUBLIC KEY-----", "alg": "RS256" } }
298302
}
299303
],
@@ -347,7 +351,7 @@ yay, api backend
347351
oauth failed with
348352

349353
=== TEST 7: Token introspection request fails with app_key
350-
Token introspection policy retrieves client_id and client_secret and
354+
Token introspection policy retrieves client_id and client_secret and
351355
introspection endpoint from the oidc_issuer_endpoint of the service configuration.
352356
When authentication_method = 1, the request fails.
353357
--- backend
@@ -400,11 +404,104 @@ Authentication failed
400404
[error]
401405
oauth failed with
402406

407+
=== TEST 8: Token introspection request success with oidc issuer endpoint loaded from the IDP
408+
Token introspection policy retrieves client_id and client_secret and
409+
introspection endpoint from the oidc_issuer_endpoint of the service configuration.
410+
--- env eval
411+
( 'APICAST_CONFIGURATION_LOADER' => 'lazy' )
412+
--- backend
413+
location = /issuer/endpoint/.well-known/openid-configuration {
414+
content_by_lua_block {
415+
local base = "http://" .. ngx.var.host .. ':' .. ngx.var.server_port
416+
ngx.header.content_type = 'application/json;charset=utf-8'
417+
ngx.say(require('cjson').encode {
418+
issuer = 'https://example.com/auth/realms/apicast',
419+
id_token_signing_alg_values_supported = { 'RS256' },
420+
jwks_uri = base .. '/jwks',
421+
introspection_endpoint = base .. '/token/introspection',
422+
})
423+
}
424+
}
403425

426+
location = /jwks {
427+
content_by_lua_block {
428+
ngx.header.content_type = 'application/json;charset=utf-8'
429+
ngx.say([[
430+
{ "keys": [
431+
{ "kty":"RSA","kid":"somekid",
432+
"n":"sKXP3pwND3rkQ1gx9nMb4By7bmWnHYo2kAAsFD5xq0IDn26zv64tjmuNBHpI6BmkLPk8mIo0B1E8MkxdKZeozQ","e":"AQAB",
433+
"alg":"RS256" }
434+
] }
435+
]])
436+
}
437+
}
404438
405-
=== TEST 8: Token introspection request success with oidc issuer endpoint loaded from the IDP
439+
location = /token/introspection {
440+
content_by_lua_block {
441+
local credential = ngx.decode_base64(require('ngx.re').split(ngx.req.get_headers()['Authorization'], ' ', 'oj')[2])
442+
require('luassert').are.equal('app:appsec', credential)
443+
ngx.say('{"active": true}')
444+
}
445+
}
446+
447+
location = /transactions/oauth_authrep.xml {
448+
content_by_lua_block { ngx.exit(200) }
449+
}
450+
451+
--- configuration
452+
{
453+
"services": [
454+
{
455+
"backend_version": "oauth",
456+
"proxy": {
457+
"authentication_method": "oidc",
458+
"oidc_issuer_endpoint": "http://app:appsec@test_backend:$TEST_NGINX_SERVER_PORT/issuer/endpoint",
459+
"api_backend": "http://test:$TEST_NGINX_SERVER_PORT/",
460+
"proxy_rules": [
461+
{ "pattern": "/", "http_method": "GET", "metric_system_name": "hits", "delta": 1 }
462+
],
463+
"policy_chain": [
464+
{
465+
"name": "apicast.policy.token_introspection",
466+
"configuration": {
467+
"auth_type": "use_3scale_oidc_issuer_endpoint"
468+
}
469+
},
470+
{ "name": "apicast.policy.apicast" }
471+
]
472+
}
473+
}
474+
]
475+
}
476+
--- upstream
477+
location /echo {
478+
content_by_lua_block {
479+
ngx.say('yay, api backend');
480+
}
481+
}
482+
--- request
483+
GET /echo
484+
--- more_headers eval
485+
use Crypt::JWT qw(encode_jwt);
486+
my $jwt = encode_jwt(payload => {
487+
aud => 'the_token_audience',
488+
sub => 'someone',
489+
iss => 'https://example.com/auth/realms/apicast',
490+
exp => time + 3600 }, key => \$::rsa, alg => 'RS256', extra_headers => { kid => 'somekid' });
491+
"Authorization: Bearer $jwt"
492+
--- error_code: 200
493+
--- response_body
494+
yay, api backend
495+
--- no_error_log
496+
[error]
497+
oauth failed with
498+
499+
=== TEST 9: Token introspection request success with oidc issuer endpoint returning deprecated introspection attribute
406500
Token introspection policy retrieves client_id and client_secret and
407501
introspection endpoint from the oidc_issuer_endpoint of the service configuration.
502+
But the service configuration returns deprecated "token_introspection_endpoint" attribute
503+
instead of "introspection_endpoint" attribute. This is for backward compatibility.
504+
408505
--- env eval
409506
( 'APICAST_CONFIGURATION_LOADER' => 'lazy' )
410507
--- backend
@@ -416,6 +513,7 @@ location = /issuer/endpoint/.well-known/openid-configuration {
416513
issuer = 'https://example.com/auth/realms/apicast',
417514
id_token_signing_alg_values_supported = { 'RS256' },
418515
jwks_uri = base .. '/jwks',
516+
token_introspection_endpoint = base .. '/token/introspection',
419517
})
420518
}
421519
}
@@ -492,3 +590,79 @@ yay, api backend
492590
--- no_error_log
493591
[error]
494592
oauth failed with
593+
594+
=== TEST 10: Token introspection request success with oidc issuer endpoint
595+
Token introspection policy retrieves introspection endpoint from the oidc_issuer_endpoint
596+
of the service configuration. However, the introspection endpoint is not in the response
597+
--- env eval
598+
( 'APICAST_CONFIGURATION_LOADER' => 'lazy' )
599+
--- backend
600+
location = /issuer/endpoint/.well-known/openid-configuration {
601+
content_by_lua_block {
602+
local base = "http://" .. ngx.var.host .. ':' .. ngx.var.server_port
603+
ngx.header.content_type = 'application/json;charset=utf-8'
604+
ngx.say(require('cjson').encode {
605+
issuer = 'https://example.com/auth/realms/apicast',
606+
id_token_signing_alg_values_supported = { 'RS256' },
607+
jwks_uri = base .. '/jwks',
608+
})
609+
}
610+
}
611+
612+
location = /jwks {
613+
content_by_lua_block {
614+
ngx.header.content_type = 'application/json;charset=utf-8'
615+
ngx.say([[
616+
{ "keys": [
617+
{ "kty":"RSA","kid":"somekid",
618+
"n":"sKXP3pwND3rkQ1gx9nMb4By7bmWnHYo2kAAsFD5xq0IDn26zv64tjmuNBHpI6BmkLPk8mIo0B1E8MkxdKZeozQ","e":"AQAB",
619+
"alg":"RS256" }
620+
] }
621+
]])
622+
}
623+
}
624+
625+
--- configuration
626+
{
627+
"services": [
628+
{
629+
"backend_version": "oauth",
630+
"proxy": {
631+
"authentication_method": "oidc",
632+
"oidc_issuer_endpoint": "http://app:appsec@test_backend:$TEST_NGINX_SERVER_PORT/issuer/endpoint",
633+
"api_backend": "http://test:$TEST_NGINX_SERVER_PORT/",
634+
"proxy_rules": [
635+
{ "pattern": "/", "http_method": "GET", "metric_system_name": "hits", "delta": 1 }
636+
],
637+
"policy_chain": [
638+
{
639+
"name": "apicast.policy.token_introspection",
640+
"configuration": {
641+
"auth_type": "use_3scale_oidc_issuer_endpoint"
642+
}
643+
},
644+
{ "name": "apicast.policy.apicast" }
645+
]
646+
}
647+
}
648+
]
649+
}
650+
--- upstream
651+
location /echo {
652+
content_by_lua_block {
653+
ngx.say('yay, api backend');
654+
}
655+
}
656+
--- request
657+
GET /echo
658+
--- more_headers eval
659+
use Crypt::JWT qw(encode_jwt);
660+
my $jwt = encode_jwt(payload => {
661+
aud => 'the_token_audience',
662+
sub => 'someone',
663+
iss => 'https://example.com/auth/realms/apicast',
664+
exp => time + 3600 }, key => \$::rsa, alg => 'RS256', extra_headers => { kid => 'somekid' });
665+
"Authorization: Bearer $jwt"
666+
--- error_code: 403
667+
--- no_error_log
668+
[error]

0 commit comments

Comments
 (0)