mirror of https://github.com/tailscale/tailscale/
tsnet: enable node registration via federated identity
Updates: tailscale.com/corp#34148 Signed-off-by: Gesa Stupperich <gesa@tailscale.com>pull/17651/merge
Gesa Stupperich
1 week ago
committed by
Gesa Stupperich
parent
957a443b23
commit
536188c1b5
@ -0,0 +1,187 @@
|
||||
// Copyright (c) Tailscale Inc & AUTHORS
|
||||
// SPDX-License-Identifier: BSD-3-Clause
|
||||
|
||||
package oauthkey
|
||||
|
||||
import (
|
||||
"context"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestResolveAuthKey(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
clientID string
|
||||
tags []string
|
||||
wantAuthKey string
|
||||
wantErr bool
|
||||
}{
|
||||
{
|
||||
name: "keys without client secret prefix pass through unchanged",
|
||||
clientID: "tskey-auth-regular",
|
||||
tags: []string{"tag:test"},
|
||||
wantAuthKey: "tskey-auth-regular",
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "client secret without advertised tags",
|
||||
clientID: "tskey-client-abc",
|
||||
tags: nil,
|
||||
wantAuthKey: "",
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "client secret with default attributes",
|
||||
clientID: "tskey-client-abc",
|
||||
tags: []string{"tag:test"},
|
||||
wantAuthKey: "tskey-auth-xyz",
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "client secret with custom attributes",
|
||||
clientID: "tskey-client-abc?ephemeral=false&preauthorized=true",
|
||||
tags: []string{"tag:test"},
|
||||
wantAuthKey: "tskey-auth-xyz",
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "client secret with unknown attribute",
|
||||
clientID: "tskey-client-abc?unknown=value",
|
||||
tags: []string{"tag:test"},
|
||||
wantAuthKey: "",
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "oauth client secret with invalid attribute value",
|
||||
clientID: "tskey-client-abc?ephemeral=invalid",
|
||||
tags: []string{"tag:test"},
|
||||
wantAuthKey: "",
|
||||
wantErr: true,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
srv := mockControlServer(t)
|
||||
defer srv.Close()
|
||||
|
||||
// resolveAuthKey reads custom control plane URLs off the baseURL attribute
|
||||
// on the client secret string. Therefore, append the baseURL attribute with
|
||||
// the mock control server URL to any client secret in order to hit the mock
|
||||
// server instead of the default control API.
|
||||
if strings.HasPrefix(tt.clientID, "tskey-client") {
|
||||
if !strings.Contains(tt.clientID, "?") {
|
||||
tt.clientID += "?baseURL=" + srv.URL
|
||||
} else {
|
||||
tt.clientID += "&baseURL=" + srv.URL
|
||||
}
|
||||
}
|
||||
|
||||
got, err := resolveAuthKey(context.Background(), tt.clientID, tt.tags)
|
||||
|
||||
if tt.wantErr {
|
||||
if err == nil {
|
||||
t.Error("want error but got none")
|
||||
return
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
if err != nil {
|
||||
t.Errorf("want no error, got %q", err)
|
||||
return
|
||||
}
|
||||
|
||||
if got != tt.wantAuthKey {
|
||||
t.Errorf("want authKey = %q, got %q", tt.wantAuthKey, got)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestResolveAuthKeyAttributes(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
clientSecret string
|
||||
wantEphemeral bool
|
||||
wantPreauth bool
|
||||
wantBaseURL string
|
||||
}{
|
||||
{
|
||||
name: "default values",
|
||||
clientSecret: "tskey-client-abc",
|
||||
wantEphemeral: true,
|
||||
wantPreauth: false,
|
||||
wantBaseURL: "https://api.tailscale.com",
|
||||
},
|
||||
{
|
||||
name: "ephemeral=false",
|
||||
clientSecret: "tskey-client-abc?ephemeral=false",
|
||||
wantEphemeral: false,
|
||||
wantPreauth: false,
|
||||
wantBaseURL: "https://api.tailscale.com",
|
||||
},
|
||||
{
|
||||
name: "preauthorized=true",
|
||||
clientSecret: "tskey-client-abc?preauthorized=true",
|
||||
wantEphemeral: true,
|
||||
wantPreauth: true,
|
||||
wantBaseURL: "https://api.tailscale.com",
|
||||
},
|
||||
{
|
||||
name: "baseURL=https://api.example.com",
|
||||
clientSecret: "tskey-client-abc?baseURL=https://api.example.com",
|
||||
wantEphemeral: true,
|
||||
wantPreauth: false,
|
||||
wantBaseURL: "https://api.example.com",
|
||||
},
|
||||
{
|
||||
name: "all custom values",
|
||||
clientSecret: "tskey-client-abc?ephemeral=false&preauthorized=true&baseURL=https://api.example.com",
|
||||
wantEphemeral: false,
|
||||
wantPreauth: true,
|
||||
wantBaseURL: "https://api.example.com",
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
strippedSecret, ephemeral, preauth, baseURL, err := parseOptionalAttributes(tt.clientSecret)
|
||||
if err != nil {
|
||||
t.Fatalf("want no error, got %q", err)
|
||||
}
|
||||
if strippedSecret != "tskey-client-abc" {
|
||||
t.Errorf("want tskey-client-abc, got %q", strippedSecret)
|
||||
}
|
||||
if ephemeral != tt.wantEphemeral {
|
||||
t.Errorf("want ephemeral = %v, got %v", tt.wantEphemeral, ephemeral)
|
||||
}
|
||||
if preauth != tt.wantPreauth {
|
||||
t.Errorf("want preauth = %v, got %v", tt.wantPreauth, preauth)
|
||||
}
|
||||
if baseURL != tt.wantBaseURL {
|
||||
t.Errorf("want baseURL = %v, got %v", tt.wantBaseURL, baseURL)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func mockControlServer(t *testing.T) *httptest.Server {
|
||||
t.Helper()
|
||||
|
||||
return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
switch {
|
||||
case strings.Contains(r.URL.Path, "/api/v2/oauth/token"):
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
w.Write([]byte(`{"access_token":"access-123","token_type":"Bearer","expires_in":3600}`))
|
||||
case strings.Contains(r.URL.Path, "/api/v2/tailnet") && strings.Contains(r.URL.Path, "/keys"):
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
w.Write([]byte(`{"key":"tskey-auth-xyz"}`))
|
||||
default:
|
||||
w.WriteHeader(http.StatusNotFound)
|
||||
}
|
||||
}))
|
||||
}
|
||||
Loading…
Reference in New Issue