1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
|
// Copyright 2022 The Sigstore Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//go:build e2e
// +build e2e
package oidc
import (
"context"
"errors"
"os"
"testing"
coreoidc "github.com/coreos/go-oidc/v3/oidc"
"github.com/go-rod/rod"
"github.com/stretchr/testify/require"
"github.com/stretchr/testify/suite"
"golang.org/x/oauth2"
)
type claims struct {
Email string `json:"email"`
Verified bool `json:"email_verified"`
Subject string `json:"sub"`
}
func identityFromClaims(c claims) (string, error) {
if c.Email != "" {
if !c.Verified {
return "", errors.New("not verified by identity provider")
}
return c.Email, nil
}
if c.Subject == "" {
return "", errors.New("no subject found in claims")
}
return c.Subject, nil
}
// identityFromIDToken extracts the email or subject claim from an `IDToken“
func identityFromIDToken(tok *IDToken) (string, error) {
claims := claims{}
oidcTok := tok.IDToken
if err := oidcTok.Claims(&claims); err != nil {
return "", err
}
return identityFromClaims(claims)
}
type InteractiveOIDCSuite struct {
suite.Suite
}
func (suite *InteractiveOIDCSuite) TestInteractiveIDTokenSource() {
ctx := context.Background()
urlCh := make(chan string)
defer close(urlCh)
browserOpener := func(input string) error {
urlCh <- input
return nil
}
provider, err := coreoidc.NewProvider(ctx, os.Getenv("OIDC_ISSUER"))
require.Nil(suite.T(), err)
cfg := oauth2.Config{
ClientID: os.Getenv("OIDC_ID"),
ClientSecret: "",
Endpoint: provider.Endpoint(),
Scopes: []string{coreoidc.ScopeOpenID, "email"},
}
ts := &interactiveIDTokenSource{
cfg: cfg,
oidp: provider,
browser: browserOpener,
}
go func() {
authCodeURL := <-urlCh
page := rod.New().MustConnect().MustPage(authCodeURL)
page.MustElement("body > div.dex-container > div > div > div:nth-child(2) > a > button").MustClick()
}()
idToken, err := ts.IDToken(ctx)
require.Nil(suite.T(), err)
email, err := identityFromIDToken(idToken)
require.Nil(suite.T(), err)
require.NotNil(suite.T(), email)
require.Equal(suite.T(), "kilgore@kilgore.trout", email)
}
func TestInteractiveOIDCFlow(t *testing.T) {
suite.Run(t, new(InteractiveOIDCSuite))
}
|
