-
Notifications
You must be signed in to change notification settings - Fork 978
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix: webhook transient payload in OIDC login flows (#3857)
* fix: transient payload with OIDC login
- Loading branch information
Showing
6 changed files
with
127 additions
and
28 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,74 @@ | ||
| // Copyright © 2024 Ory Corp | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| package hooktest | ||
|
|
||
| import ( | ||
| "encoding/base64" | ||
| "fmt" | ||
| "net/http" | ||
| "net/http/httptest" | ||
| "slices" | ||
| "testing" | ||
|
|
||
| "github.com/stretchr/testify/assert" | ||
| "github.com/stretchr/testify/require" | ||
| "github.com/tidwall/gjson" | ||
|
|
||
| "github.com/ory/kratos/driver/config" | ||
| "github.com/ory/x/configx" | ||
| "github.com/ory/x/ioutilx" | ||
| ) | ||
|
|
||
| var jsonnet = base64.StdEncoding.EncodeToString([]byte("function(ctx) ctx")) | ||
|
|
||
| type Server struct { | ||
| *httptest.Server | ||
| LastBody []byte | ||
| } | ||
|
|
||
| // NewServer returns a new webhook server for testing. | ||
| func NewServer() *Server { | ||
| s := new(Server) | ||
| httptestServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { | ||
| s.LastBody = ioutilx.MustReadAll(r.Body) | ||
| w.WriteHeader(http.StatusOK) | ||
| })) | ||
|
|
||
| s.Server = httptestServer | ||
|
|
||
| return s | ||
| } | ||
|
|
||
| // HookConfig returns the hook configuration for calling the webhook server. | ||
| func (s *Server) HookConfig() config.SelfServiceHook { | ||
| return config.SelfServiceHook{ | ||
| Name: "web_hook", | ||
| Config: []byte(fmt.Sprintf(` | ||
| { | ||
| "method": "POST", | ||
| "url": "%s", | ||
| "body": "base64://%s" | ||
| }`, s.URL, jsonnet)), | ||
| } | ||
| } | ||
|
|
||
| func (s *Server) AssertTransientPayload(t *testing.T, expected string) { | ||
| require.NotEmpty(t, s.LastBody) | ||
| actual := gjson.GetBytes(s.LastBody, "flow.transient_payload").String() | ||
| assert.JSONEq(t, expected, actual, "%+v", actual) | ||
| } | ||
|
|
||
| // SetConfig adds the webhook to the list of hooks for the given key and restores | ||
| // the original configuration after the test. | ||
| func (s *Server) SetConfig(t *testing.T, conf *configx.Provider, key string) { | ||
| var newValue []config.SelfServiceHook | ||
| original := conf.Get(key) | ||
| if originalHooks, ok := original.([]config.SelfServiceHook); ok { | ||
| newValue = slices.Clone(originalHooks) | ||
| } | ||
| require.NoError(t, conf.Set(key, append(newValue, s.HookConfig()))) | ||
| t.Cleanup(func() { | ||
| _ = conf.Set(key, original) | ||
| }) | ||
| } |
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -18,6 +18,7 @@ import ( | |
| "testing" | ||
| "time" | ||
|
|
||
| "github.com/ory/kratos/selfservice/hook/hooktest" | ||
| "github.com/ory/x/sqlxx" | ||
|
|
||
| "github.com/ory/kratos/hydra" | ||
|
|
@@ -457,38 +458,76 @@ func TestStrategy(t *testing.T) { | |
| } | ||
|
|
||
| t.Run("case=register and then login", func(t *testing.T) { | ||
| postRegistrationWebhook := hooktest.NewServer() | ||
| t.Cleanup(postRegistrationWebhook.Close) | ||
| postLoginWebhook := hooktest.NewServer() | ||
| t.Cleanup(postLoginWebhook.Close) | ||
|
|
||
| postRegistrationWebhook.SetConfig(t, conf.GetProvider(ctx), | ||
| config.HookStrategyKey(config.ViperKeySelfServiceRegistrationAfter, identity.CredentialsTypeOIDC.String())) | ||
| postLoginWebhook.SetConfig(t, conf.GetProvider(ctx), | ||
| config.HookStrategyKey(config.ViperKeySelfServiceLoginAfter, config.HookGlobal)) | ||
|
|
||
| subject = "[email protected]" | ||
| scope = []string{"openid", "offline"} | ||
|
|
||
| t.Run("case=should pass registration", func(t *testing.T) { | ||
| transientPayload := `{"data": "registration"}` | ||
| r := newBrowserRegistrationFlow(t, returnTS.URL, time.Minute) | ||
| action := assertFormValues(t, r.ID, "valid") | ||
| res, body := makeRequest(t, "valid", action, url.Values{}) | ||
| res, body := makeRequest(t, "valid", action, url.Values{ | ||
| "transient_payload": {transientPayload}, | ||
| }) | ||
| assertIdentity(t, res, body) | ||
| expectTokens(t, "valid", body) | ||
| assert.Equal(t, "valid", gjson.GetBytes(body, "authentication_methods.0.provider").String(), "%s", body) | ||
|
|
||
| postRegistrationWebhook.AssertTransientPayload(t, transientPayload) | ||
| }) | ||
|
|
||
| t.Run("case=should pass login", func(t *testing.T) { | ||
| transientPayload := `{"data": "login"}` | ||
| r := newBrowserLoginFlow(t, returnTS.URL, time.Minute) | ||
| action := assertFormValues(t, r.ID, "valid") | ||
| res, body := makeRequest(t, "valid", action, url.Values{}) | ||
| res, body := makeRequest(t, "valid", action, url.Values{ | ||
| "transient_payload": {transientPayload}, | ||
| }) | ||
| assertIdentity(t, res, body) | ||
| expectTokens(t, "valid", body) | ||
| assert.Equal(t, "valid", gjson.GetBytes(body, "authentication_methods.0.provider").String(), "%s", body) | ||
|
|
||
| postLoginWebhook.AssertTransientPayload(t, transientPayload) | ||
| }) | ||
| }) | ||
|
|
||
| t.Run("case=login without registered account", func(t *testing.T) { | ||
| postRegistrationWebhook := hooktest.NewServer() | ||
| t.Cleanup(postRegistrationWebhook.Close) | ||
| postLoginWebhook := hooktest.NewServer() | ||
| t.Cleanup(postLoginWebhook.Close) | ||
|
|
||
| postRegistrationWebhook.SetConfig(t, conf.GetProvider(ctx), | ||
| config.HookStrategyKey(config.ViperKeySelfServiceRegistrationAfter, identity.CredentialsTypeOIDC.String())) | ||
| postLoginWebhook.SetConfig(t, conf.GetProvider(ctx), | ||
| config.HookStrategyKey(config.ViperKeySelfServiceLoginAfter, config.HookGlobal)) | ||
|
|
||
| subject = "[email protected]" | ||
| scope = []string{"openid"} | ||
|
|
||
| t.Run("case=should pass login", func(t *testing.T) { | ||
| transientPayload := `{"data": "login to registration"}` | ||
|
|
||
| r := newBrowserLoginFlow(t, returnTS.URL, time.Minute) | ||
| action := assertFormValues(t, r.ID, "valid") | ||
| res, body := makeRequest(t, "valid", action, url.Values{}) | ||
| res, body := makeRequest(t, "valid", action, url.Values{ | ||
| "transient_payload": {transientPayload}, | ||
| }) | ||
| assertIdentity(t, res, body) | ||
| assert.Equal(t, "valid", gjson.GetBytes(body, "authentication_methods.0.provider").String(), "%s", body) | ||
|
|
||
| assert.Empty(t, postLoginWebhook.LastBody, | ||
| "post login hook should not have been called, because this was a registration flow") | ||
| postRegistrationWebhook.AssertTransientPayload(t, transientPayload) | ||
| }) | ||
| }) | ||
|
|
||
|
|
||