mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-28 03:05:04 -06:00
Stephan Renatus
3286c39822
* identifier: add TLSBased This is only the identifier, the server setup still has to be done. Note that it diverges a little from what was proposed in the issue: not every client cert needs to have a CN record -- so instead, we'll use whatever is the cert's subject as client identity. * Drive-by fix: identifier_test: don't use same package for TokenBased tests. * server: require and verify client cert for AuthenticationTLS * server: allow setting CA pool via --tls-ca-cert-file * server: expose new authentication via parameter * [nit] server: simplify getListenerForHTTPServer * server_test: use httptest for integration-y TLS tests * book/security: mention TLS authn with example Signed-off-by: Stephan Renatus <srenatus@chef.io>
61 lines
1.3 KiB
Go
61 lines
1.3 KiB
Go
// Copyright 2017 The OPA Authors. All rights reserved.
|
|
// Use of this source code is governed by an Apache2
|
|
// license that can be found in the LICENSE file.
|
|
|
|
package identifier_test
|
|
|
|
import (
|
|
"net/http"
|
|
"testing"
|
|
|
|
"github.com/open-policy-agent/opa/server/identifier"
|
|
)
|
|
|
|
type mockHandler struct {
|
|
identity string
|
|
defined bool
|
|
}
|
|
|
|
func (h *mockHandler) ServeHTTP(_ http.ResponseWriter, r *http.Request) {
|
|
h.identity, h.defined = identifier.Identity(r)
|
|
}
|
|
|
|
func TestTokenBased(t *testing.T) {
|
|
|
|
mock := &mockHandler{}
|
|
handler := identifier.NewTokenBased(mock)
|
|
|
|
req, err := http.NewRequest(http.MethodGet, "/foo/bar/baz", nil)
|
|
if err != nil {
|
|
t.Fatalf("Unexpected error creating request: %v", err)
|
|
}
|
|
|
|
tests := []struct {
|
|
value string
|
|
expected string
|
|
defined bool
|
|
}{
|
|
{"", "", false},
|
|
{"Bearer this-is-the-token", "this-is-the-token", true},
|
|
{"Bearer this-is-the-token-with-spaces", "this-is-the-token-with-spaces", true},
|
|
}
|
|
|
|
for _, tc := range tests {
|
|
|
|
if tc.value != "" {
|
|
req.Header.Set("Authorization", tc.value)
|
|
}
|
|
|
|
handler.ServeHTTP(nil, req)
|
|
|
|
if mock.defined != tc.defined {
|
|
t.Fatalf("Expected defined to be %v but got: %v", tc.defined, mock.defined)
|
|
}
|
|
|
|
if mock.identity != tc.expected {
|
|
t.Fatalf("Expected identity to be %s but got: %s", tc.expected, mock.identity)
|
|
}
|
|
}
|
|
|
|
}
|