jcoffey-dev
7dae9b29fd
Upstream commit: 474dd0229cb20cf513036619781ed97bd8073c3f Enterprise-only files removed or emptied: 63 Enterprise-only snippets removed: 117 in 50 files Dangling module declarations removed: 5 Cargo edits turning enterprise off: 14 Verification: clean Enterprise feature gates left for rebuilt features: 19 in 18 files Produced by tools/fork/strip.py. The full report is in docs/fork/strip-reports/ on main.
88 lines
2.8 KiB
Rust
88 lines
2.8 KiB
Rust
/*
|
|
* SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
|
|
*
|
|
* SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
|
|
*/
|
|
|
|
use crate::utils::{http::HttpRequest, server::TestServerBuilder};
|
|
use registry::{
|
|
schema::structs::{Directory, OidcDirectory},
|
|
types::map::Map,
|
|
};
|
|
|
|
const EXTERNAL_ENDPOINT: &str =
|
|
"http://localhost:9080/realms/stalwart/protocol/openid-connect/auth";
|
|
const INTERNAL_ENDPOINT: &str = "https://127.0.0.1:8899/login";
|
|
|
|
pub async fn test() {
|
|
println!("Running OIDC account discovery tests...");
|
|
crate::utils::containers::ensure_keycloak().await;
|
|
let test = TestServerBuilder::new("directory_discovery_test")
|
|
.await
|
|
.with_default_listeners()
|
|
.await
|
|
.disable_services()
|
|
.with_object(Directory::Oidc(oidc_test_directory()))
|
|
.await
|
|
.build()
|
|
.await;
|
|
assert!(
|
|
test.server
|
|
.get_default_directory()
|
|
.and_then(|directory| directory.oidc_discovery_document())
|
|
.is_some_and(|discovery| discovery.document.authorization_endpoint
|
|
== EXTERNAL_ENDPOINT),
|
|
"The default directory is not the test OpenID Connect provider"
|
|
);
|
|
let http = HttpRequest::new();
|
|
|
|
for (account_name, expected) in [
|
|
("[email protected]", EXTERNAL_ENDPOINT),
|
|
("[email protected]", EXTERNAL_ENDPOINT),
|
|
(
|
|
"[email protected]%[email protected]",
|
|
EXTERNAL_ENDPOINT,
|
|
),
|
|
("admin", INTERNAL_ENDPOINT),
|
|
("[email protected]%admin", INTERNAL_ENDPOINT),
|
|
("[email protected]%Admin", INTERNAL_ENDPOINT),
|
|
("john.doe@", INTERNAL_ENDPOINT),
|
|
] {
|
|
assert_eq!(
|
|
authorization_endpoint(&http, account_name).await,
|
|
expected,
|
|
"Unexpected discovery document for {account_name:?}"
|
|
);
|
|
}
|
|
}
|
|
|
|
async fn authorization_endpoint(http: &HttpRequest, account_name: &str) -> String {
|
|
http.get::<serde_json::Value>(&format!(
|
|
"/api/discover/{}",
|
|
account_name.replace('%', "%25")
|
|
))
|
|
.await
|
|
.unwrap()
|
|
.get("authorization_endpoint")
|
|
.and_then(|endpoint| endpoint.as_str())
|
|
.unwrap_or_else(|| panic!("No authorization endpoint returned for {account_name:?}"))
|
|
.to_string()
|
|
}
|
|
|
|
fn oidc_test_directory() -> OidcDirectory {
|
|
OidcDirectory {
|
|
description: "Test OIDC directory".to_string(),
|
|
issuer_url: "http://localhost:9080/realms/stalwart".to_string(),
|
|
claim_username: "preferred_username".to_string(),
|
|
claim_name: Some("name".to_string()),
|
|
claim_groups: Some("groups".to_string()),
|
|
require_audience: Some("stalwart".to_string()),
|
|
require_scopes: Map::new(vec![
|
|
"email".to_string(),
|
|
"profile".to_string(),
|
|
"openid".to_string(),
|
|
]),
|
|
..Default::default()
|
|
}
|
|
}
|