AlinsRan commented on code in PR #13649:
URL: https://github.com/apache/apisix/pull/13649#discussion_r3708716022
##########
t/plugin/openid-connect.t:
##########
@@ -1845,7 +1849,278 @@ done
-=== TEST 51: Configure plugin with a custom session.cookie_name.
+=== TEST 51a: Accept PAR, DPoP, and client assertion algorithm options.
+--- config
+ location /t {
+ content_by_lua_block {
+ local plugin = require("apisix.plugins.openid-connect")
+ local ok, err = plugin.check_schema({
+ client_id = "a",
+ discovery =
"https://example.com/.well-known/openid-configuration";,
+ bearer_only = false,
+ use_pkce = true,
+ par = {
+ enabled = true,
+ endpoint = "https://example.com/par";,
+ endpoint_auth_method = "private_key_jwt",
+ },
+ dpop = {
+ enabled = true,
+ signing_alg = "PS256",
+ private_key = "-----BEGIN PRIVATE
KEY-----\nMIIEowIBAAK\n-----END PRIVATE KEY-----",
+ public_jwk = {
+ kty = "RSA",
+ e = "AQAB",
+ n = "abc",
+ },
+ },
+ token_endpoint_auth_method = "private_key_jwt",
+ client_rsa_private_key = "-----BEGIN RSA PRIVATE
KEY-----\nMIIEowIBAAK\n-----END RSA PRIVATE KEY-----",
+ client_jwt_assertion_alg = "PS256",
+ client_jwt_assertion_audience =
"https://issuer.example.com/token";,
+ session = { secret = "jwcE5v3pM9VhqLxmxFOH9uZaLo8u7KQK" },
+ })
+ if not ok then
+ ngx.say(err)
+ end
+ ngx.say("done")
+ }
+ }
+--- response_body
+done
+
+
+
+=== TEST 52b: Reject unsupported DPoP signing algorithm in schema.
+--- config
+ location /t {
+ content_by_lua_block {
+ local plugin = require("apisix.plugins.openid-connect")
+ local ok, err = plugin.check_schema({
+ client_id = "a",
+ client_secret = "b",
+ discovery =
"https://example.com/.well-known/openid-configuration";,
+ dpop = {
+ signing_alg = "HS256",
+ },
+ session = { secret = "jwcE5v3pM9VhqLxmxFOH9uZaLo8u7KQK" },
+ })
+ if not ok then
+ ngx.say(err)
+ end
+ ngx.say("done")
+ }
+ }
+--- response_body
+property "dpop" validation failed: property "signing_alg" validation failed:
matches none of the enum values
+done
+
+
+
+=== TEST 53c: Accept PAR enabled without endpoint in schema.
+--- config
+ location /t {
+ content_by_lua_block {
+ local plugin = require("apisix.plugins.openid-connect")
+ local ok, err = plugin.check_schema({
+ client_id = "a",
+ client_secret = "b",
+ discovery =
"https://example.com/.well-known/openid-configuration";,
+ par = {
+ enabled = true,
+ },
+ session = { secret = "jwcE5v3pM9VhqLxmxFOH9uZaLo8u7KQK" },
+ })
+ if not ok then
+ ngx.say(err)
+ end
+ ngx.say("done")
+ }
+ }
+--- response_body
+done
+
+
+
+=== TEST 54d: Reject DPoP enabled without key material in schema.
+--- config
+ location /t {
+ content_by_lua_block {
+ local plugin = require("apisix.plugins.openid-connect")
+ local ok, err = plugin.check_schema({
+ client_id = "a",
+ client_secret = "b",
+ discovery =
"https://example.com/.well-known/openid-configuration";,
+ dpop = {
+ enabled = true,
+ },
+ session = { secret = "jwcE5v3pM9VhqLxmxFOH9uZaLo8u7KQK" },
+ })
+ if not ok then
+ ngx.say(err)
+ end
+ ngx.say("done")
+ }
+ }
+--- response_body
+property "dpop" validation failed: then clause did not match
+done
+
+
+
+=== TEST 55e: Reject private key material in DPoP public JWK.
+--- config
+ location /t {
+ content_by_lua_block {
+ local plugin = require("apisix.plugins.openid-connect")
+ local ok, err = plugin.check_schema({
+ client_id = "a",
+ client_secret = "b",
+ discovery =
"https://example.com/.well-known/openid-configuration";,
+ dpop = {
+ enabled = true,
+ private_key = "-----BEGIN PRIVATE
KEY-----\nMIIEowIBAAK\n-----END PRIVATE KEY-----",
+ public_jwk = {
+ kty = "RSA",
+ e = "AQAB",
+ n = "abc",
+ d = "private-exponent",
+ },
+ },
+ session = { secret = "jwcE5v3pM9VhqLxmxFOH9uZaLo8u7KQK" },
+ })
+ if not ok then
+ ngx.say(err)
+ end
+ ngx.say("done")
+ }
+ }
+--- response_body_like
+property "dpop" validation failed: property "public_jwk" validation failed:.*
+done
+
+
+
+=== TEST 56: PAR runtime mapping sends authorization parameters through PAR.
+--- http_config
+ server {
+ listen 16969;
+ server_name localhost;
+
+ location /.well-known/openid-configuration {
+ content_by_lua_block {
+ ngx.header.content_type = "application/json"
+ ngx.say([[{
+ "issuer": "http://127.0.0.1:16969";,
+ "authorization_endpoint":
"http://127.0.0.1:16969/authorize";,
+ "token_endpoint": "http://127.0.0.1:16969/token";,
+ "userinfo_endpoint": "http://127.0.0.1:16969/userinfo";,
+ "jwks_uri": "http://127.0.0.1:16969/jwks";
+ }]])
+ }
+ }
+
+ location /par {
Review Comment:
Correction to my own suggestion here, after tracing it properly: asserting
`dpop_jkt` on the PAR mock covers `use_dpop` and `dpop_public_jwk`, but it
cannot reach `dpop_private_key` or `dpop_signing_alg`. A DPoP proof is only
built when `ep_name == "token"` (`openidc.lua:913`); the PAR call passes
`"pushed authorization request"`, so the private key is never parsed and the
algorithm never selected. That is also why a placeholder key works there — it
is never loaded.
So `dpop_jkt` gets two of the four mappings, not all four. Covering the
remaining two through the full code flow needs a token-endpoint mock and a real
key. A cheaper option that covers all of them directly: export the flattening
function the way `_build_session_opts` already is, and assert each flat name
plus that `conf.par`/`conf.dpop` are cleared. That catches a typo in any
assignment, which was the original concern.
Separately, one assertion in TEST 56 is currently vacuous. If
`pushed_authorization_request_endpoint_auth_method` were not mapped,
`lua-resty-openidc` falls back to `opts.token_endpoint_auth_method`
(`openidc.lua:543-546`), which the schema defaults to `client_secret_basic` —
and the mock accepts that too, so the test still passes and still returns the
302. Having the mock require `client_id`/`client_secret` in the POST body pins
it, since only `client_secret_post` puts them there. I verified this both ways:
with the assertion added, removing the mapping fails the test; without it,
removing the mapping does not.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
