|
| 1 | +import urllib.error |
1 | 2 | from unittest import skip |
| 3 | +from unittest.mock import patch |
2 | 4 |
|
3 | 5 | from django.test import TestCase, override_settings |
4 | 6 |
|
5 | 7 | import requests |
6 | 8 | import requests_mock |
| 9 | +from digid_eherkenning.choices import ( |
| 10 | + DigestAlgorithms, |
| 11 | + SignatureAlgorithms, |
| 12 | + XMLContentTypes, |
| 13 | +) |
| 14 | +from digid_eherkenning.models import DigidConfiguration |
7 | 15 | from django_setup_configuration.exceptions import ConfigurationRunFailed |
8 | 16 | from mozilla_django_oidc_db.models import ( |
9 | 17 | OpenIDConnectConfig, |
10 | 18 | UserInformationClaimsSources, |
11 | 19 | ) |
| 20 | +from simple_certmanager.constants import CertificateTypes |
12 | 21 |
|
13 | 22 | from digid_eherkenning_oidc_generics.models import ( |
14 | 23 | OpenIDConnectDigiDConfig, |
|
17 | 26 |
|
18 | 27 | from ...bootstrap.auth import ( |
19 | 28 | AdminOIDCConfigurationStep, |
| 29 | + DigiDConfigurationStep, |
20 | 30 | DigiDOIDCConfigurationStep, |
21 | 31 | eHerkenningOIDCConfigurationStep, |
22 | 32 | ) |
|
33 | 43 | "jwks_uri": f"{IDENTITY_PROVIDER}protocol/openid-connect/certs", |
34 | 44 | } |
35 | 45 |
|
| 46 | +DIGID_XML_METADATA_PATH = ( |
| 47 | + "src/open_inwoner/configurations/tests/bootstrap/files/digid-metadata.xml" |
| 48 | +) |
| 49 | + |
36 | 50 |
|
37 | 51 | @override_settings( |
38 | 52 | DIGID_OIDC_OIDC_RP_CLIENT_ID="client-id", |
@@ -656,3 +670,147 @@ def test_is_configured(self): |
656 | 670 | config.configure() |
657 | 671 |
|
658 | 672 | self.assertTrue(config.is_configured()) |
| 673 | + |
| 674 | + |
| 675 | +@override_settings( |
| 676 | + DIGID_CERTIFICATE_LABEL="DigiD certificate", |
| 677 | + DIGID_CERTIFICATE_TYPE=CertificateTypes.key_pair, |
| 678 | + DIGID_CERTIFICATE_PUBLIC_CERTIFICATE="/tmp/certificate.crt", |
| 679 | + DIGID_CERTIFICATE_PRIVATE_KEY="/tmp/key.key", |
| 680 | + DIGID_METADATA_FILE_SOURCE="http://metadata.local/file.xml", |
| 681 | + DIGID_ENTITY_ID="1234", |
| 682 | + DIGID_BASE_URL="http://digid.local", |
| 683 | + DIGID_SERVICE_NAME="OIP", |
| 684 | + DIGID_SERVICE_DESCRIPTION="Open Inwoner", |
| 685 | + DIGID_WANT_ASSERTIONS_SIGNED=False, |
| 686 | + DIGID_WANT_ASSERTIONS_ENCRYPTED=True, |
| 687 | + DIGID_ARTIFACT_RESOLVE_CONTENT_TYPE=XMLContentTypes.text_xml, |
| 688 | + DIGID_KEY_PASSPHRASE="foo", |
| 689 | + DIGID_SIGNATURE_ALGORITHM=SignatureAlgorithms.dsa_sha1, |
| 690 | + DIGID_DIGEST_ALGORITHM=DigestAlgorithms.sha512, |
| 691 | + DIGID_TECHNICAL_CONTACT_PERSON_TELEPHONE="0612345678", |
| 692 | + DIGID_TECHNICAL_CONTACT_PERSON_EMAIL="[email protected]", |
| 693 | + DIGID_ORGANIZATION_URL="http://open-inwoner.local", |
| 694 | + DIGID_ORGANIZATION_NAME="Open Inwoner", |
| 695 | + DIGID_ATTRIBUTE_CONSUMING_SERVICE_INDEX="2", |
| 696 | + DIGID_REQUESTED_ATTRIBUTES=[ |
| 697 | + {"name": "bsn", "required": True}, |
| 698 | + {"name": "email", "required": False}, |
| 699 | + ], |
| 700 | + DIGID_SLO=False, |
| 701 | +) |
| 702 | +class DigiDConfigurationTests(TestCase): |
| 703 | + def test_configure(self): |
| 704 | + with open(DIGID_XML_METADATA_PATH) as f: |
| 705 | + with patch( |
| 706 | + "onelogin.saml2.idp_metadata_parser.urllib2.urlopen", return_value=f |
| 707 | + ): |
| 708 | + DigiDConfigurationStep().configure() |
| 709 | + |
| 710 | + config = DigidConfiguration.get_solo() |
| 711 | + |
| 712 | + self.assertEqual(config.certificate.label, "DigiD certificate") |
| 713 | + self.assertEqual(config.certificate.type, CertificateTypes.key_pair) |
| 714 | + self.assertEqual(config.certificate.public_certificate, "/tmp/certificate.crt") |
| 715 | + self.assertEqual(config.certificate.private_key, "/tmp/key.key") |
| 716 | + self.assertEqual(config.key_passphrase, "foo") |
| 717 | + self.assertEqual(config.metadata_file_source, "http://metadata.local/file.xml") |
| 718 | + self.assertEqual( |
| 719 | + config.idp_service_entity_id, |
| 720 | + "https://was-preprod1.digid.nl/saml/idp/metadata", |
| 721 | + ) |
| 722 | + self.assertTrue(config.idp_metadata_file.path.endswith(".xml")) |
| 723 | + self.assertEqual(config.entity_id, "1234") |
| 724 | + self.assertEqual(config.base_url, "http://digid.local") |
| 725 | + self.assertEqual(config.service_name, "OIP") |
| 726 | + self.assertEqual(config.service_description, "Open Inwoner") |
| 727 | + self.assertEqual(config.want_assertions_signed, False) |
| 728 | + self.assertEqual(config.want_assertions_encrypted, True) |
| 729 | + self.assertEqual(config.artifact_resolve_content_type, XMLContentTypes.text_xml) |
| 730 | + self.assertEqual(config.signature_algorithm, SignatureAlgorithms.dsa_sha1) |
| 731 | + self.assertEqual(config.digest_algorithm, DigestAlgorithms.sha512) |
| 732 | + self.assertEqual(config.technical_contact_person_telephone, "0612345678") |
| 733 | + self. assertEqual( config. technical_contact_person_email, "[email protected]") |
| 734 | + self.assertEqual(config.organization_url, "http://open-inwoner.local") |
| 735 | + self.assertEqual(config.organization_name, "Open Inwoner") |
| 736 | + self.assertEqual(config.attribute_consuming_service_index, "2") |
| 737 | + self.assertEqual( |
| 738 | + config.requested_attributes, |
| 739 | + [{"name": "bsn", "required": True}, {"name": "email", "required": False}], |
| 740 | + ) |
| 741 | + self.assertEqual(config.slo, False) |
| 742 | + |
| 743 | + # TODO asserts |
| 744 | + |
| 745 | + @override_settings( |
| 746 | + DIGID_WANT_ASSERTIONS_SIGNED=None, |
| 747 | + DIGID_WANT_ASSERTIONS_ENCRYPTED=None, |
| 748 | + DIGID_ARTIFACT_RESOLVE_CONTENT_TYPE=None, |
| 749 | + DIGID_KEY_PASSPHRASE=None, |
| 750 | + DIGID_SIGNATURE_ALGORITHM=None, |
| 751 | + DIGID_DIGEST_ALGORITHM=None, |
| 752 | + DIGID_ATTRIBUTE_CONSUMING_SERVICE_INDEX=None, |
| 753 | + DIGID_REQUESTED_ATTRIBUTES=None, |
| 754 | + DIGID_SLO=None, |
| 755 | + ) |
| 756 | + def test_configure_use_defaults(self): |
| 757 | + with open(DIGID_XML_METADATA_PATH) as f: |
| 758 | + with patch( |
| 759 | + "onelogin.saml2.idp_metadata_parser.urllib2.urlopen", return_value=f |
| 760 | + ): |
| 761 | + DigiDConfigurationStep().configure() |
| 762 | + |
| 763 | + config = DigidConfiguration.get_solo() |
| 764 | + |
| 765 | + self.assertEqual(config.key_passphrase, "") |
| 766 | + self.assertEqual(config.want_assertions_signed, True) |
| 767 | + self.assertEqual(config.want_assertions_encrypted, False) |
| 768 | + self.assertEqual(config.artifact_resolve_content_type, XMLContentTypes.soap_xml) |
| 769 | + self.assertEqual(config.signature_algorithm, SignatureAlgorithms.rsa_sha1) |
| 770 | + self.assertEqual(config.digest_algorithm, DigestAlgorithms.sha1) |
| 771 | + self.assertEqual(config.attribute_consuming_service_index, "1") |
| 772 | + self.assertEqual( |
| 773 | + config.requested_attributes, |
| 774 | + [{"name": "bsn", "required": True}], |
| 775 | + ) |
| 776 | + self.assertEqual(config.slo, True) |
| 777 | + |
| 778 | + # TODO asserts |
| 779 | + |
| 780 | + def test_configure_failure(self): |
| 781 | + exceptions = (urllib.error.HTTPError, urllib.error.URLError) |
| 782 | + for exception in exceptions: |
| 783 | + with self.subTest(exception=exception): |
| 784 | + with patch( |
| 785 | + "onelogin.saml2.idp_metadata_parser.urllib2.urlopen", |
| 786 | + side_effect=exception, |
| 787 | + ): |
| 788 | + with self.assertRaises(ConfigurationRunFailed): |
| 789 | + DigiDConfigurationStep().configure() |
| 790 | + |
| 791 | + config = DigidConfiguration.get_solo() |
| 792 | + |
| 793 | + self.assertFalse(config.certificate, None) |
| 794 | + |
| 795 | + @skip("Testing config for DigiD OIDC is not implemented yet") |
| 796 | + @requests_mock.Mocker() |
| 797 | + def test_configuration_check_ok(self, m): |
| 798 | + raise NotImplementedError |
| 799 | + |
| 800 | + @skip("Testing config for DigiD OIDC is not implemented yet") |
| 801 | + @requests_mock.Mocker() |
| 802 | + def test_configuration_check_failures(self, m): |
| 803 | + raise NotImplementedError |
| 804 | + |
| 805 | + def test_is_configured(self): |
| 806 | + config = DigiDConfigurationStep() |
| 807 | + |
| 808 | + self.assertFalse(config.is_configured()) |
| 809 | + |
| 810 | + with open(DIGID_XML_METADATA_PATH) as f: |
| 811 | + with patch( |
| 812 | + "onelogin.saml2.idp_metadata_parser.urllib2.urlopen", return_value=f |
| 813 | + ): |
| 814 | + config.configure() |
| 815 | + |
| 816 | + self.assertTrue(config.is_configured()) |
0 commit comments