Skip to content

fix the rest of parallel tests working with old token format #26009

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-robot merged 2 commits into from
Apr 4, 2021
Merged

fix the rest of parallel tests working with old token format #26009

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ba41e87
fix remaining token format discrepancies in parallel tests
stlaz Mar 23, 2021
43893ad
Remove the test for the authenticator accepting old-format tokens
stlaz Mar 23, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 17 additions & 14 deletions test/extended/authorization/scopes.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,8 +59,9 @@ var _ = g.Describe("[sig-auth][Feature:OpenShiftAuthorization] scopes", func() {
t.Fatalf("unexpected error: %v", err)
}

whoamiOnlyTokenStr, sha256WhoamiOnlyTokenStr := exutil.GenerateOAuthTokenPair()
whoamiOnlyToken := &oauthv1.OAuthAccessToken{
ObjectMeta: metav1.ObjectMeta{Name: "whoami-token-plus-some-padding-here-to-make-the-limit-" + oc.Namespace()},
Copy link
Contributor

@sttts sttts Mar 30, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

where is "to make the limit" proporty gone? Do we lose anything? Or this just does not matter anymore because we always hash?

Copy link
Contributor Author

@stlaz stlaz Mar 30, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the tokens have a requirement on at least 32 characters length, that's something we're keeping even though it may not make too much sense now that we're using hashed tokens

ObjectMeta: metav1.ObjectMeta{Name: sha256WhoamiOnlyTokenStr},
ClientName: "openshift-challenging-client",
ExpiresIn: 200,
Scopes: []string{scope.UserInfo},
Expand All @@ -74,7 +75,7 @@ var _ = g.Describe("[sig-auth][Feature:OpenShiftAuthorization] scopes", func() {
oc.AddResourceToDelete(oauthv1.GroupVersion.WithResource("oauthaccesstokens"), whoamiOnlyToken)

whoamiConfig := rest.AnonymousClientConfig(oc.AdminConfig())
whoamiConfig.BearerToken = whoamiOnlyToken.Name
whoamiConfig.BearerToken = whoamiOnlyTokenStr

if _, err := buildv1client.NewForConfigOrDie(whoamiConfig).BuildV1().Builds(projectName).List(context.Background(), metav1.ListOptions{}); !kapierrors.IsForbidden(err) {
t.Fatalf("unexpected error: %v", err)
Expand Down Expand Up @@ -155,8 +156,9 @@ var _ = g.Describe("[sig-auth][Feature:OpenShiftAuthorization] scopes", func() {
t.Fatalf("unexpected error: %v", err)
}

nonEscalatingEditTokenStr, sha256NonEscalatingEditTokenStr := exutil.GenerateOAuthTokenPair()
nonEscalatingEditToken := &oauthv1.OAuthAccessToken{
ObjectMeta: metav1.ObjectMeta{Name: "non-escalating-edit-plus-some-padding-here-to-make-the-limit-" + oc.Namespace()},
ObjectMeta: metav1.ObjectMeta{Name: sha256NonEscalatingEditTokenStr},
ClientName: "openshift-challenging-client",
ExpiresIn: 200,
Scopes: []string{scope.ClusterRoleIndicator + "edit:*"},
Expand All @@ -170,7 +172,7 @@ var _ = g.Describe("[sig-auth][Feature:OpenShiftAuthorization] scopes", func() {
oc.AddResourceToDelete(oauthv1.GroupVersion.WithResource("oauthaccesstokens"), nonEscalatingEditToken)

nonEscalatingEditConfig := rest.AnonymousClientConfig(oc.AdminConfig())
nonEscalatingEditConfig.BearerToken = nonEscalatingEditToken.Name
nonEscalatingEditConfig.BearerToken = nonEscalatingEditTokenStr
nonEscalatingEditClient, err := kclientset.NewForConfig(nonEscalatingEditConfig)
if err != nil {
t.Fatalf("unexpected error: %v", err)
Expand All @@ -180,8 +182,9 @@ var _ = g.Describe("[sig-auth][Feature:OpenShiftAuthorization] scopes", func() {
t.Fatalf("unexpected error: %v", err)
}

escalatingEditTokenStr, sha256EscalatingEditToken := exutil.GenerateOAuthTokenPair()
escalatingEditToken := &oauthv1.OAuthAccessToken{
ObjectMeta: metav1.ObjectMeta{Name: "escalating-edit-plus-some-padding-here-to-make-the-limit-" + oc.Namespace()},
ObjectMeta: metav1.ObjectMeta{Name: sha256EscalatingEditToken},
ClientName: "openshift-challenging-client",
ExpiresIn: 200,
Scopes: []string{scope.ClusterRoleIndicator + "edit:*:!"},
Expand All @@ -195,7 +198,7 @@ var _ = g.Describe("[sig-auth][Feature:OpenShiftAuthorization] scopes", func() {
oc.AddResourceToDelete(oauthv1.GroupVersion.WithResource("oauthaccesstokens"), escalatingEditToken)

escalatingEditConfig := rest.AnonymousClientConfig(oc.AdminConfig())
escalatingEditConfig.BearerToken = escalatingEditToken.Name
escalatingEditConfig.BearerToken = escalatingEditTokenStr
escalatingEditClient, err := kclientset.NewForConfig(escalatingEditConfig)
if err != nil {
t.Fatalf("unexpected error: %v", err)
Expand Down Expand Up @@ -308,7 +311,7 @@ var _ = g.Describe("[sig-auth][Feature:OpenShiftAuthorization] scopes", func() {
name: "no scopes",
fail: true,
obj: &oauthv1.OAuthAccessToken{
ObjectMeta: metav1.ObjectMeta{Name: "tokenlongenoughtobecreatedwithoutfailing-" + oc.Namespace()},
ObjectMeta: metav1.ObjectMeta{Name: "sha256~tokenlongenoughtobecreatedwithoutfailing-" + oc.Namespace()},
ClientName: client.Name,
UserName: "name",
UserUID: "uid",
Expand All @@ -319,7 +322,7 @@ var _ = g.Describe("[sig-auth][Feature:OpenShiftAuthorization] scopes", func() {
name: "denied literal",
fail: true,
obj: &oauthv1.OAuthAccessToken{
ObjectMeta: metav1.ObjectMeta{Name: "tokenlongenoughtobecreatedwithoutfailing-" + oc.Namespace()},
ObjectMeta: metav1.ObjectMeta{Name: "sha256~tokenlongenoughtobecreatedwithoutfailing-" + oc.Namespace()},
ClientName: client.Name,
UserName: "name",
UserUID: "uid",
Expand All @@ -331,7 +334,7 @@ var _ = g.Describe("[sig-auth][Feature:OpenShiftAuthorization] scopes", func() {
name: "denied role",
fail: true,
obj: &oauthv1.OAuthAccessToken{
ObjectMeta: metav1.ObjectMeta{Name: "tokenlongenoughtobecreatedwithoutfailing-" + oc.Namespace()},
ObjectMeta: metav1.ObjectMeta{Name: "sha256~tokenlongenoughtobecreatedwithoutfailing-" + oc.Namespace()},
ClientName: client.Name,
UserName: "name",
UserUID: "uid",
Expand All @@ -342,7 +345,7 @@ var _ = g.Describe("[sig-auth][Feature:OpenShiftAuthorization] scopes", func() {
{
name: "ok role",
obj: &oauthv1.OAuthAccessToken{
ObjectMeta: metav1.ObjectMeta{Name: "tokenlongenoughtobecreatedwithoutfailing-" + oc.Namespace()},
ObjectMeta: metav1.ObjectMeta{Name: "sha256~tokenlongenoughtobecreatedwithoutfailing-" + oc.Namespace()},
ClientName: client.Name,
UserName: "name",
UserUID: "uid",
Expand Down Expand Up @@ -374,7 +377,7 @@ var _ = g.Describe("[sig-auth][Feature:OpenShiftAuthorization] scopes", func() {
name: "no scopes",
fail: true,
obj: &oauthv1.OAuthAuthorizeToken{
ObjectMeta: metav1.ObjectMeta{Name: "tokenlongenoughtobecreatedwithoutfailing-" + oc.Namespace()},
ObjectMeta: metav1.ObjectMeta{Name: "sha256~tokenlongenoughtobecreatedwithoutfailing-" + oc.Namespace()},
ClientName: client.Name,
ExpiresIn: 86400,
UserName: "name",
Expand All @@ -386,7 +389,7 @@ var _ = g.Describe("[sig-auth][Feature:OpenShiftAuthorization] scopes", func() {
name: "denied literal",
fail: true,
obj: &oauthv1.OAuthAuthorizeToken{
ObjectMeta: metav1.ObjectMeta{Name: "tokenlongenoughtobecreatedwithoutfailing-" + oc.Namespace()},
ObjectMeta: metav1.ObjectMeta{Name: "sha256~tokenlongenoughtobecreatedwithoutfailing-" + oc.Namespace()},
ClientName: client.Name,
ExpiresIn: 86400,
UserName: "name",
Expand All @@ -399,7 +402,7 @@ var _ = g.Describe("[sig-auth][Feature:OpenShiftAuthorization] scopes", func() {
name: "denied role",
fail: true,
obj: &oauthv1.OAuthAuthorizeToken{
ObjectMeta: metav1.ObjectMeta{Name: "tokenlongenoughtobecreatedwithoutfailing-" + oc.Namespace()},
ObjectMeta: metav1.ObjectMeta{Name: "sha256~tokenlongenoughtobecreatedwithoutfailing-" + oc.Namespace()},
ClientName: client.Name,
ExpiresIn: 86400,
UserName: "name",
Expand All @@ -411,7 +414,7 @@ var _ = g.Describe("[sig-auth][Feature:OpenShiftAuthorization] scopes", func() {
{
name: "ok role",
obj: &oauthv1.OAuthAuthorizeToken{
ObjectMeta: metav1.ObjectMeta{Name: "tokenlongenoughtobecreatedwithoutfailing-" + oc.Namespace()},
ObjectMeta: metav1.ObjectMeta{Name: "sha256~tokenlongenoughtobecreatedwithoutfailing-" + oc.Namespace()},
ClientName: client.Name,
ExpiresIn: 86400,
UserName: "name",
Expand Down
8 changes: 4 additions & 4 deletions test/extended/cli/mustgather.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,11 +131,11 @@ var _ = g.Describe("[sig-cli] oc adm must-gather", func() {
}

// makes some tokens that should not show in the audit logs
const tokenName = "must-gather-audit-logs-token-plus-some-padding-here-to-make-the-limit"
_, sha256TokenName := exutil.GenerateOAuthTokenPair()
oauthClient := oauthv1client.NewForConfigOrDie(oc.AdminConfig())
_, err1 := oauthClient.OAuthAccessTokens().Create(context.Background(), &oauthv1.OAuthAccessToken{
ObjectMeta: metav1.ObjectMeta{
Name: tokenName,
Name: sha256TokenName,
},
ClientName: "openshift-challenging-client",
ExpiresIn: 30,
Expand All @@ -147,7 +147,7 @@ var _ = g.Describe("[sig-cli] oc adm must-gather", func() {
o.Expect(err1).NotTo(o.HaveOccurred())
_, err2 := oauthClient.OAuthAuthorizeTokens().Create(context.Background(), &oauthv1.OAuthAuthorizeToken{
ObjectMeta: metav1.ObjectMeta{
Name: tokenName,
Name: sha256TokenName,
},
ClientName: "openshift-challenging-client",
ExpiresIn: 30,
Expand Down Expand Up @@ -241,7 +241,7 @@ var _ = g.Describe("[sig-cli] oc adm must-gather", func() {
// - if on 4.6 but not upgraded => disable check
// - if on 4.6 and we have been upgraded from older release => keep the check.
if upgradedFrom45 {
for _, token := range []string{"oauthaccesstokens", "oauthauthorizetokens", tokenName} {
for _, token := range []string{"oauthaccesstokens", "oauthauthorizetokens", sha256TokenName} {
o.Expect(text).NotTo(o.ContainSubstring(token))
}
}
Expand Down
10 changes: 5 additions & 5 deletions test/extended/oauth/client_secret.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ import (
exutil "github.com/openshift/origin/test/extended/util"
)

const authzTokenName string = "oauth-client-with-plus-with-more-than-thirty-two-characters-in-this-very-long-name"
var authzToken, sha256AuthzToken = exutil.GenerateOAuthTokenPair()

var _ = g.Describe("[sig-auth][Feature:OAuthServer]", func() {
defer g.GinkgoRecover()
Expand Down Expand Up @@ -65,7 +65,7 @@ var _ = g.Describe("[sig-auth][Feature:OAuthServer]", func() {
g.By("create synthetic authz token")
oauthAuthorizeToken, err := oc.AdminOauthClient().OauthV1().OAuthAuthorizeTokens().Create(ctx, &oauthv1.OAuthAuthorizeToken{
ObjectMeta: metav1.ObjectMeta{
Name: authzTokenName,
Name: sha256AuthzToken,
},
ClientName: oauthClient.Name,
ExpiresIn: 100000000,
Expand Down Expand Up @@ -108,7 +108,7 @@ var _ = g.Describe("[sig-auth][Feature:OAuthServer]", func() {
func queryClientAuthRequest(host string) *http.Request {
req, err := http.NewRequest("POST", "https://"+host+"/oauth/token?"+
"grant_type=authorization_code&"+
"code="+authzTokenName+"&"+
"code="+authzToken+"&"+
"client_id=oauth-client-with-plus&"+
"client_secret=secret%2Bwith%2Bplus",
nil)
Expand All @@ -120,7 +120,7 @@ func queryClientAuthRequest(host string) *http.Request {
func bodyClientAuthRequest(host string) *http.Request {
req, err := http.NewRequest("POST", "https://"+host+"/oauth/token",
bytes.NewBufferString("grant_type=authorization_code&"+
"code="+authzTokenName+"&"+
"code="+authzToken+"&"+
"client_id=oauth-client-with-plus&"+
"client_secret=secret%2Bwith%2Bplus",
),
Expand All @@ -133,7 +133,7 @@ func bodyClientAuthRequest(host string) *http.Request {
func headerClientAuthRequest(host string) *http.Request {
req, err := http.NewRequest("POST", "https://"+host+"/oauth/token",
bytes.NewBufferString("grant_type=authorization_code&"+
"code="+authzTokenName,
"code="+authzToken,
),
)
o.Expect(err).NotTo(o.HaveOccurred())
Expand Down
36 changes: 0 additions & 36 deletions test/extended/oauth/token.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,42 +27,6 @@ var _ = g.Describe("[sig-auth][Feature:OAuthServer] OAuth Authenticator", func()
oc := exutil.NewCLI("oauth-access-token-e2e-test")
ctx := context.Background()

g.It(fmt.Sprintf("accepts classic non-prefixed access tokens"), func() {
Copy link
Contributor

@sttts sttts Mar 30, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

does this imply an inverse test when we switch over?

A blocker BZ would be good not to forget.

Copy link
Contributor Author

@stlaz stlaz Mar 30, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we won't be able to e2e test that since we won't be able to create such a token, but might still be worth a unit test

user, err := oc.AdminUserClient().UserV1().Users().Create(ctx, &userv1.User{
TypeMeta: metav1.TypeMeta{},
ObjectMeta: metav1.ObjectMeta{
Name: "oauth-access-token-e2e-test-user-classical",
},
FullName: "test user",
}, metav1.CreateOptions{})
o.Expect(err).NotTo(o.HaveOccurred())
oc.AddResourceToDelete(userv1.GroupVersion.WithResource("users"), user)

g.By("creating a classic oauth access token")
token := base64.RawURLEncoding.EncodeToString([]byte(uuid.New()))
classicTokenObject, err := oc.AdminOauthClient().OauthV1().OAuthAccessTokens().Create(ctx, &oauthv1.OAuthAccessToken{
ObjectMeta: metav1.ObjectMeta{
Name: token,
},
UserName: user.Name,
UserUID: string(user.UID),
ClientName: "openshift-challenging-client",
Scopes: []string{"user:info"},
RedirectURI: "https://127.0.0.1:12000/oauth/token/implicit",
}, metav1.CreateOptions{})
o.Expect(err).NotTo(o.HaveOccurred())
oc.AddResourceToDelete(oauthv1.GroupVersion.WithResource("oauthaccesstokens"), classicTokenObject)

g.By("authenticating using the classic access token as bearer token")
gotUser, err := whoamiWithToken(token, oc)
o.Expect(err).NotTo(o.HaveOccurred())
o.Expect(gotUser.Name).To(o.Equal(user.Name))

g.By("not-authenticating using a sha256 prefixed access token as bearer token")
_, err = whoamiWithToken("sha256~"+token, oc)
o.Expect(errors.IsUnauthorized(err)).To(o.BeTrue())
})

g.It(fmt.Sprintf("accepts sha256 access tokens"), func() {
user, err := oc.AdminUserClient().UserV1().Users().Create(ctx, &userv1.User{
TypeMeta: metav1.TypeMeta{},
Expand Down
6 changes: 3 additions & 3 deletions test/extended/project/project.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@ import (
corev1 "k8s.io/api/core/v1"
rbacv1 "k8s.io/api/rbac/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/util/rand"
"k8s.io/apimachinery/pkg/util/sets"
"k8s.io/apimachinery/pkg/util/wait"
"k8s.io/apimachinery/pkg/watch"
Expand Down Expand Up @@ -572,8 +571,9 @@ func GetScopedClientForUser(oc *exutil.CLI, username string, scopes []string) (*
return nil, err
}

tokenStr, sha256TokenStr := exutil.GenerateOAuthTokenPair()
token := &oauthv1.OAuthAccessToken{
ObjectMeta: metav1.ObjectMeta{Name: fmt.Sprintf("%s-token-plus-some-padding-here-to-make-the-limit-%d", username, rand.Int())},
ObjectMeta: metav1.ObjectMeta{Name: sha256TokenStr},
ClientName: "openshift-challenging-client",
ExpiresIn: 86400,
Scopes: scopes,
Expand All @@ -587,6 +587,6 @@ func GetScopedClientForUser(oc *exutil.CLI, username string, scopes []string) (*
oc.AddResourceToDelete(oauthv1.GroupVersion.WithResource("oauthaccesstokens"), token)

scopedConfig := rest.AnonymousClientConfig(oc.AdminConfig())
scopedConfig.BearerToken = token.Name
scopedConfig.BearerToken = tokenStr
return scopedConfig, nil
}
2 changes: 0 additions & 2 deletions test/extended/util/annotate/generated/zz_generated.annotations.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.