You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by GitBox <gi...@apache.org> on 2022/08/29 09:28:09 UTC
[GitHub] [apisix-dashboard] ljzsmllx opened a new pull request, #2608: Add login filter of OpenID-Connect Login
ljzsmllx opened a new pull request, #2608:
URL: https://github.com/apache/apisix-dashboard/pull/2608
Please answer these questions before submitting a pull request, **or your PR will get closed**.
**Why submit this pull request?**
- [ ] Bugfix
- [ ] New feature provided
- [ ] Improve performance
- [ ] Backport patches
**What changes will this PR take into?**
feat: The series PR will add a new feature to the Dashboard to make it support login through OpenID-Connect.
This PR will adds a login filter.
**Related issues**
**Checklist:**
- [ ] Did you explain what problem does this PR solve? Or what new features have been added?
- [ ] Have you added corresponding test cases?
- [ ] Have you modified the corresponding document?
- [ ] Is this PR backward compatible? If it is not backward compatible, please discuss on the mailing list first
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix-dashboard] ljzsmllx commented on a diff in pull request #2608: feat: Add login filter of OpenID-Connect Login
Posted by GitBox <gi...@apache.org>.
ljzsmllx commented on code in PR #2608:
URL: https://github.com/apache/apisix-dashboard/pull/2608#discussion_r1007641587
##########
.github/workflows/backend-e2e-test.yml:
##########
@@ -44,6 +44,8 @@ jobs:
sed -i 's@127.0.0.1@0.0.0.0/0@' ./api/conf/conf.yaml
sed -i '/172.16.238.10:2379/a\ - 172.16.238.11:2379' ./api/conf/conf.yaml
sed -i '/172.16.238.10:2379/a\ - 172.16.238.12:2379' ./api/conf/conf.yaml
+ sed -i 's@0.0.0.0/0:9000@127.0.0.1:9000@' ./api/conf/conf.yaml
Review Comment:
My tutor taught me to change that. @starsz
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix-dashboard] starsz commented on a diff in pull request #2608: feat: Add login filter of OpenID-Connect Login
Posted by GitBox <gi...@apache.org>.
starsz commented on code in PR #2608:
URL: https://github.com/apache/apisix-dashboard/pull/2608#discussion_r957093572
##########
api/internal/conf/conf.go:
##########
@@ -19,6 +19,7 @@ package conf
import (
"encoding/json"
"fmt"
+ "github.com/gorilla/sessions"
Review Comment:
Code style. You should put this line to part2.
##########
api/internal/filter/oidc.go:
##########
@@ -0,0 +1,126 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package filter
+
+import (
+ "encoding/json"
+ "fmt"
+ "github.com/apisix/manager-api/internal/conf"
+ "github.com/gin-gonic/gin"
+ "net/http"
+ "strings"
+)
+
+func Oidc() gin.HandlerFunc {
+ return func(c *gin.Context) {
+ if c.Request.URL.Path == "/apisix/admin/oidc/login" {
+ cookie, _ := conf.CookieStore.Get(c.Request, "oidc")
+ cookie.Save(c.Request, c.Writer)
+
+ // 携带必要的参数，跳转到authing的登录页面
+ redirectUrl := fmt.Sprintf("http://127.0.0.1:%d/apisix/admin/%s", conf.ServerPort, conf.OidcConf.RedirectUri)
+ url := "https://kjoenlkbhfkg-demo.authing.cn/oidc/auth?" +
Review Comment:
Do not put the specific URI to the project.
##########
api/internal/filter/oidc.go:
##########
@@ -0,0 +1,126 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package filter
+
+import (
+ "encoding/json"
+ "fmt"
+ "github.com/apisix/manager-api/internal/conf"
+ "github.com/gin-gonic/gin"
+ "net/http"
+ "strings"
+)
+
+func Oidc() gin.HandlerFunc {
+ return func(c *gin.Context) {
+ if c.Request.URL.Path == "/apisix/admin/oidc/login" {
+ cookie, _ := conf.CookieStore.Get(c.Request, "oidc")
+ cookie.Save(c.Request, c.Writer)
+
+ // 携带必要的参数，跳转到authing的登录页面
+ redirectUrl := fmt.Sprintf("http://127.0.0.1:%d/apisix/admin/%s", conf.ServerPort, conf.OidcConf.RedirectUri)
+ url := "https://kjoenlkbhfkg-demo.authing.cn/oidc/auth?" +
+ fmt.Sprintf("client_id=%s&client_secret=%s&redirect_uri=%s",
+ conf.OidcConf.ClientId, conf.OidcConf.ClientSecret, redirectUrl) +
+ "&response_type=code&scope=openid&state=4756806&prompt=consent"
+ c.Redirect(302, url)
+ c.Abort()
+ return
+ }
+
+ if c.Request.URL.Path == "/apisix/admin/oidc/callback" {
+ // 获取cookie，如果没有从apisix/admin/oidc/login页面顺着过来，不会有这个cookie，于是cookie.IsNew就为true，会返回403状态码
+ cookie, _ := conf.CookieStore.Get(c.Request, "oidc")
+ if cookie.IsNew {
+ c.AbortWithStatus(403)
+ }
+
+ //获取携带的授权码code
+ code := c.Query("code")
+ httpClient := new(http.Client)
+ var req *http.Request
+ var resp *http.Response
+ var err error
+
+ //访问authing指定api，用code换取access_token
+ redirectUrl := fmt.Sprintf("http://127.0.0.1:%d/apisix/admin/%s", conf.ServerPort, conf.OidcConf.RedirectUri)
+ payload := strings.NewReader(fmt.Sprintf("client_id=%s&client_secret=%s&code=%s&redirect_uri=%s&"+
+ "grant_type=authorization_code", conf.OidcConf.ClientId, conf.OidcConf.ClientSecret, code, redirectUrl))
+ uri := "https://kjoenlkbhfkg-demo.authing.cn/oidc/token"
+ req, _ = http.NewRequest("POST", uri, payload)
+ header := req.Header
+ header.Add("Accept", "application/json")
+ header.Add("Content-Type", "application/x-www-form-urlencoded")
+
+ resp, err = httpClient.Do(req)
+ if err != nil {
+ c.AbortWithStatus(500)
+ }
+
+ tokenInfo := make(map[string]string)
+ err = json.NewDecoder(resp.Body).Decode(&tokenInfo)
+ if err != nil {
+ c.AbortWithStatus(500)
+ }
+
+ //访问authing指定api，用access_token换取用户的id
+ uri = "https://kjoenlkbhfkg-demo.authing.cn/oidc/me"
+ req, err = http.NewRequest("GET", uri, nil)
+ if err != nil {
+ c.AbortWithStatus(500)
+ }
+ header = req.Header
+ header.Add("Authorization", "Bearer "+tokenInfo["access_token"])
+
+ resp, err = httpClient.Do(req)
+ if err != nil {
+ c.AbortWithStatus(500)
+ }
+
+ userInfo := make(map[string]string)
+ _ = json.NewDecoder(resp.Body).Decode(&userInfo)
+
+ //设置cookie的oidc_id参数和过期时间，并保存cookie
+ cookie, _ = conf.CookieStore.Get(c.Request, "oidc")
+ cookie.Options.MaxAge = conf.OidcConf.ExpireTime
+ cookie.Values["oidc_id"] = userInfo["sub"]
+ cookie.Save(c.Request, c.Writer)
+ //设置全局变量OidcId和IfOidcLogin
+ conf.OidcId = userInfo["sub"]
+ conf.OidcLogin = true
Review Comment:
Don't set the field here. You should consider the concurrent requests.
##########
api/internal/filter/oidc.go:
##########
@@ -0,0 +1,126 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package filter
+
+import (
+ "encoding/json"
+ "fmt"
+ "github.com/apisix/manager-api/internal/conf"
+ "github.com/gin-gonic/gin"
+ "net/http"
+ "strings"
+)
+
+func Oidc() gin.HandlerFunc {
+ return func(c *gin.Context) {
+ if c.Request.URL.Path == "/apisix/admin/oidc/login" {
+ cookie, _ := conf.CookieStore.Get(c.Request, "oidc")
+ cookie.Save(c.Request, c.Writer)
+
+ // 携带必要的参数，跳转到authing的登录页面
+ redirectUrl := fmt.Sprintf("http://127.0.0.1:%d/apisix/admin/%s", conf.ServerPort, conf.OidcConf.RedirectUri)
+ url := "https://kjoenlkbhfkg-demo.authing.cn/oidc/auth?" +
+ fmt.Sprintf("client_id=%s&client_secret=%s&redirect_uri=%s",
+ conf.OidcConf.ClientId, conf.OidcConf.ClientSecret, redirectUrl) +
+ "&response_type=code&scope=openid&state=4756806&prompt=consent"
+ c.Redirect(302, url)
+ c.Abort()
+ return
+ }
+
+ if c.Request.URL.Path == "/apisix/admin/oidc/callback" {
+ // 获取cookie，如果没有从apisix/admin/oidc/login页面顺着过来，不会有这个cookie，于是cookie.IsNew就为true，会返回403状态码
+ cookie, _ := conf.CookieStore.Get(c.Request, "oidc")
+ if cookie.IsNew {
+ c.AbortWithStatus(403)
+ }
+
+ //获取携带的授权码code
+ code := c.Query("code")
+ httpClient := new(http.Client)
+ var req *http.Request
+ var resp *http.Response
+ var err error
+
+ //访问authing指定api，用code换取access_token
+ redirectUrl := fmt.Sprintf("http://127.0.0.1:%d/apisix/admin/%s", conf.ServerPort, conf.OidcConf.RedirectUri)
+ payload := strings.NewReader(fmt.Sprintf("client_id=%s&client_secret=%s&code=%s&redirect_uri=%s&"+
+ "grant_type=authorization_code", conf.OidcConf.ClientId, conf.OidcConf.ClientSecret, code, redirectUrl))
+ uri := "https://kjoenlkbhfkg-demo.authing.cn/oidc/token"
+ req, _ = http.NewRequest("POST", uri, payload)
+ header := req.Header
+ header.Add("Accept", "application/json")
+ header.Add("Content-Type", "application/x-www-form-urlencoded")
+
+ resp, err = httpClient.Do(req)
+ if err != nil {
+ c.AbortWithStatus(500)
+ }
+
+ tokenInfo := make(map[string]string)
+ err = json.NewDecoder(resp.Body).Decode(&tokenInfo)
+ if err != nil {
+ c.AbortWithStatus(500)
+ }
+
+ //访问authing指定api，用access_token换取用户的id
+ uri = "https://kjoenlkbhfkg-demo.authing.cn/oidc/me"
+ req, err = http.NewRequest("GET", uri, nil)
+ if err != nil {
+ c.AbortWithStatus(500)
+ }
+ header = req.Header
+ header.Add("Authorization", "Bearer "+tokenInfo["access_token"])
+
+ resp, err = httpClient.Do(req)
+ if err != nil {
+ c.AbortWithStatus(500)
+ }
+
+ userInfo := make(map[string]string)
+ _ = json.NewDecoder(resp.Body).Decode(&userInfo)
Review Comment:
You can refer the lib `"github.com/coreos/go-oidc"`
##########
api/internal/filter/oidc.go:
##########
@@ -0,0 +1,126 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package filter
+
+import (
+ "encoding/json"
+ "fmt"
+ "github.com/apisix/manager-api/internal/conf"
+ "github.com/gin-gonic/gin"
+ "net/http"
+ "strings"
+)
+
+func Oidc() gin.HandlerFunc {
+ return func(c *gin.Context) {
+ if c.Request.URL.Path == "/apisix/admin/oidc/login" {
+ cookie, _ := conf.CookieStore.Get(c.Request, "oidc")
+ cookie.Save(c.Request, c.Writer)
+
+ // 携带必要的参数，跳转到authing的登录页面
+ redirectUrl := fmt.Sprintf("http://127.0.0.1:%d/apisix/admin/%s", conf.ServerPort, conf.OidcConf.RedirectUri)
+ url := "https://kjoenlkbhfkg-demo.authing.cn/oidc/auth?" +
+ fmt.Sprintf("client_id=%s&client_secret=%s&redirect_uri=%s",
+ conf.OidcConf.ClientId, conf.OidcConf.ClientSecret, redirectUrl) +
+ "&response_type=code&scope=openid&state=4756806&prompt=consent"
+ c.Redirect(302, url)
+ c.Abort()
+ return
+ }
+
+ if c.Request.URL.Path == "/apisix/admin/oidc/callback" {
+ // 获取cookie，如果没有从apisix/admin/oidc/login页面顺着过来，不会有这个cookie，于是cookie.IsNew就为true，会返回403状态码
+ cookie, _ := conf.CookieStore.Get(c.Request, "oidc")
+ if cookie.IsNew {
+ c.AbortWithStatus(403)
+ }
+
+ //获取携带的授权码code
+ code := c.Query("code")
+ httpClient := new(http.Client)
+ var req *http.Request
+ var resp *http.Response
+ var err error
+
+ //访问authing指定api，用code换取access_token
+ redirectUrl := fmt.Sprintf("http://127.0.0.1:%d/apisix/admin/%s", conf.ServerPort, conf.OidcConf.RedirectUri)
+ payload := strings.NewReader(fmt.Sprintf("client_id=%s&client_secret=%s&code=%s&redirect_uri=%s&"+
+ "grant_type=authorization_code", conf.OidcConf.ClientId, conf.OidcConf.ClientSecret, code, redirectUrl))
+ uri := "https://kjoenlkbhfkg-demo.authing.cn/oidc/token"
+ req, _ = http.NewRequest("POST", uri, payload)
+ header := req.Header
+ header.Add("Accept", "application/json")
+ header.Add("Content-Type", "application/x-www-form-urlencoded")
+
+ resp, err = httpClient.Do(req)
+ if err != nil {
+ c.AbortWithStatus(500)
Review Comment:
Should add `return`.
##########
api/internal/filter/oidc.go:
##########
@@ -0,0 +1,126 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package filter
+
+import (
+ "encoding/json"
+ "fmt"
+ "github.com/apisix/manager-api/internal/conf"
+ "github.com/gin-gonic/gin"
+ "net/http"
+ "strings"
+)
+
+func Oidc() gin.HandlerFunc {
+ return func(c *gin.Context) {
+ if c.Request.URL.Path == "/apisix/admin/oidc/login" {
+ cookie, _ := conf.CookieStore.Get(c.Request, "oidc")
+ cookie.Save(c.Request, c.Writer)
+
+ // 携带必要的参数，跳转到authing的登录页面
+ redirectUrl := fmt.Sprintf("http://127.0.0.1:%d/apisix/admin/%s", conf.ServerPort, conf.OidcConf.RedirectUri)
+ url := "https://kjoenlkbhfkg-demo.authing.cn/oidc/auth?" +
+ fmt.Sprintf("client_id=%s&client_secret=%s&redirect_uri=%s",
+ conf.OidcConf.ClientId, conf.OidcConf.ClientSecret, redirectUrl) +
+ "&response_type=code&scope=openid&state=4756806&prompt=consent"
+ c.Redirect(302, url)
+ c.Abort()
+ return
+ }
+
+ if c.Request.URL.Path == "/apisix/admin/oidc/callback" {
+ // 获取cookie，如果没有从apisix/admin/oidc/login页面顺着过来，不会有这个cookie，于是cookie.IsNew就为true，会返回403状态码
+ cookie, _ := conf.CookieStore.Get(c.Request, "oidc")
+ if cookie.IsNew {
+ c.AbortWithStatus(403)
Review Comment:
Need add return here.
##########
api/internal/filter/oidc.go:
##########
@@ -0,0 +1,126 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package filter
+
+import (
+ "encoding/json"
+ "fmt"
+ "github.com/apisix/manager-api/internal/conf"
+ "github.com/gin-gonic/gin"
+ "net/http"
+ "strings"
+)
+
+func Oidc() gin.HandlerFunc {
+ return func(c *gin.Context) {
+ if c.Request.URL.Path == "/apisix/admin/oidc/login" {
+ cookie, _ := conf.CookieStore.Get(c.Request, "oidc")
+ cookie.Save(c.Request, c.Writer)
+
+ // 携带必要的参数，跳转到authing的登录页面
+ redirectUrl := fmt.Sprintf("http://127.0.0.1:%d/apisix/admin/%s", conf.ServerPort, conf.OidcConf.RedirectUri)
+ url := "https://kjoenlkbhfkg-demo.authing.cn/oidc/auth?" +
+ fmt.Sprintf("client_id=%s&client_secret=%s&redirect_uri=%s",
+ conf.OidcConf.ClientId, conf.OidcConf.ClientSecret, redirectUrl) +
+ "&response_type=code&scope=openid&state=4756806&prompt=consent"
+ c.Redirect(302, url)
+ c.Abort()
+ return
+ }
+
+ if c.Request.URL.Path == "/apisix/admin/oidc/callback" {
+ // 获取cookie，如果没有从apisix/admin/oidc/login页面顺着过来，不会有这个cookie，于是cookie.IsNew就为true，会返回403状态码
+ cookie, _ := conf.CookieStore.Get(c.Request, "oidc")
+ if cookie.IsNew {
+ c.AbortWithStatus(403)
+ }
+
+ //获取携带的授权码code
+ code := c.Query("code")
+ httpClient := new(http.Client)
+ var req *http.Request
+ var resp *http.Response
+ var err error
+
+ //访问authing指定api，用code换取access_token
+ redirectUrl := fmt.Sprintf("http://127.0.0.1:%d/apisix/admin/%s", conf.ServerPort, conf.OidcConf.RedirectUri)
+ payload := strings.NewReader(fmt.Sprintf("client_id=%s&client_secret=%s&code=%s&redirect_uri=%s&"+
+ "grant_type=authorization_code", conf.OidcConf.ClientId, conf.OidcConf.ClientSecret, code, redirectUrl))
+ uri := "https://kjoenlkbhfkg-demo.authing.cn/oidc/token"
+ req, _ = http.NewRequest("POST", uri, payload)
+ header := req.Header
+ header.Add("Accept", "application/json")
+ header.Add("Content-Type", "application/x-www-form-urlencoded")
+
+ resp, err = httpClient.Do(req)
+ if err != nil {
+ c.AbortWithStatus(500)
+ }
+
+ tokenInfo := make(map[string]string)
+ err = json.NewDecoder(resp.Body).Decode(&tokenInfo)
+ if err != nil {
+ c.AbortWithStatus(500)
Review Comment:
Ditto.
##########
api/internal/filter/oidc.go:
##########
@@ -0,0 +1,126 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package filter
+
+import (
+ "encoding/json"
+ "fmt"
+ "github.com/apisix/manager-api/internal/conf"
+ "github.com/gin-gonic/gin"
+ "net/http"
+ "strings"
+)
+
+func Oidc() gin.HandlerFunc {
+ return func(c *gin.Context) {
+ if c.Request.URL.Path == "/apisix/admin/oidc/login" {
+ cookie, _ := conf.CookieStore.Get(c.Request, "oidc")
+ cookie.Save(c.Request, c.Writer)
+
+ // 携带必要的参数，跳转到authing的登录页面
+ redirectUrl := fmt.Sprintf("http://127.0.0.1:%d/apisix/admin/%s", conf.ServerPort, conf.OidcConf.RedirectUri)
+ url := "https://kjoenlkbhfkg-demo.authing.cn/oidc/auth?" +
+ fmt.Sprintf("client_id=%s&client_secret=%s&redirect_uri=%s",
+ conf.OidcConf.ClientId, conf.OidcConf.ClientSecret, redirectUrl) +
+ "&response_type=code&scope=openid&state=4756806&prompt=consent"
+ c.Redirect(302, url)
+ c.Abort()
+ return
+ }
+
+ if c.Request.URL.Path == "/apisix/admin/oidc/callback" {
+ // 获取cookie，如果没有从apisix/admin/oidc/login页面顺着过来，不会有这个cookie，于是cookie.IsNew就为true，会返回403状态码
+ cookie, _ := conf.CookieStore.Get(c.Request, "oidc")
+ if cookie.IsNew {
+ c.AbortWithStatus(403)
+ }
+
+ //获取携带的授权码code
+ code := c.Query("code")
+ httpClient := new(http.Client)
+ var req *http.Request
+ var resp *http.Response
+ var err error
+
+ //访问authing指定api，用code换取access_token
+ redirectUrl := fmt.Sprintf("http://127.0.0.1:%d/apisix/admin/%s", conf.ServerPort, conf.OidcConf.RedirectUri)
+ payload := strings.NewReader(fmt.Sprintf("client_id=%s&client_secret=%s&code=%s&redirect_uri=%s&"+
+ "grant_type=authorization_code", conf.OidcConf.ClientId, conf.OidcConf.ClientSecret, code, redirectUrl))
+ uri := "https://kjoenlkbhfkg-demo.authing.cn/oidc/token"
Review Comment:
Ditto.
##########
api/internal/filter/oidc.go:
##########
@@ -0,0 +1,126 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package filter
+
+import (
+ "encoding/json"
+ "fmt"
+ "github.com/apisix/manager-api/internal/conf"
+ "github.com/gin-gonic/gin"
+ "net/http"
+ "strings"
+)
+
+func Oidc() gin.HandlerFunc {
+ return func(c *gin.Context) {
+ if c.Request.URL.Path == "/apisix/admin/oidc/login" {
+ cookie, _ := conf.CookieStore.Get(c.Request, "oidc")
+ cookie.Save(c.Request, c.Writer)
+
+ // 携带必要的参数，跳转到authing的登录页面
+ redirectUrl := fmt.Sprintf("http://127.0.0.1:%d/apisix/admin/%s", conf.ServerPort, conf.OidcConf.RedirectUri)
+ url := "https://kjoenlkbhfkg-demo.authing.cn/oidc/auth?" +
+ fmt.Sprintf("client_id=%s&client_secret=%s&redirect_uri=%s",
+ conf.OidcConf.ClientId, conf.OidcConf.ClientSecret, redirectUrl) +
+ "&response_type=code&scope=openid&state=4756806&prompt=consent"
+ c.Redirect(302, url)
+ c.Abort()
+ return
+ }
+
+ if c.Request.URL.Path == "/apisix/admin/oidc/callback" {
+ // 获取cookie，如果没有从apisix/admin/oidc/login页面顺着过来，不会有这个cookie，于是cookie.IsNew就为true，会返回403状态码
+ cookie, _ := conf.CookieStore.Get(c.Request, "oidc")
+ if cookie.IsNew {
+ c.AbortWithStatus(403)
+ }
+
+ //获取携带的授权码code
+ code := c.Query("code")
+ httpClient := new(http.Client)
+ var req *http.Request
+ var resp *http.Response
+ var err error
+
+ //访问authing指定api，用code换取access_token
+ redirectUrl := fmt.Sprintf("http://127.0.0.1:%d/apisix/admin/%s", conf.ServerPort, conf.OidcConf.RedirectUri)
+ payload := strings.NewReader(fmt.Sprintf("client_id=%s&client_secret=%s&code=%s&redirect_uri=%s&"+
+ "grant_type=authorization_code", conf.OidcConf.ClientId, conf.OidcConf.ClientSecret, code, redirectUrl))
+ uri := "https://kjoenlkbhfkg-demo.authing.cn/oidc/token"
+ req, _ = http.NewRequest("POST", uri, payload)
+ header := req.Header
+ header.Add("Accept", "application/json")
+ header.Add("Content-Type", "application/x-www-form-urlencoded")
+
+ resp, err = httpClient.Do(req)
+ if err != nil {
+ c.AbortWithStatus(500)
+ }
Review Comment:
Should add `defer resp.Body.Close()`.
##########
api/internal/filter/oidc.go:
##########
@@ -0,0 +1,126 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package filter
+
+import (
+ "encoding/json"
+ "fmt"
+ "github.com/apisix/manager-api/internal/conf"
+ "github.com/gin-gonic/gin"
+ "net/http"
+ "strings"
+)
+
+func Oidc() gin.HandlerFunc {
+ return func(c *gin.Context) {
+ if c.Request.URL.Path == "/apisix/admin/oidc/login" {
+ cookie, _ := conf.CookieStore.Get(c.Request, "oidc")
+ cookie.Save(c.Request, c.Writer)
+
+ // 携带必要的参数，跳转到authing的登录页面
+ redirectUrl := fmt.Sprintf("http://127.0.0.1:%d/apisix/admin/%s", conf.ServerPort, conf.OidcConf.RedirectUri)
+ url := "https://kjoenlkbhfkg-demo.authing.cn/oidc/auth?" +
+ fmt.Sprintf("client_id=%s&client_secret=%s&redirect_uri=%s",
+ conf.OidcConf.ClientId, conf.OidcConf.ClientSecret, redirectUrl) +
+ "&response_type=code&scope=openid&state=4756806&prompt=consent"
+ c.Redirect(302, url)
+ c.Abort()
+ return
+ }
+
+ if c.Request.URL.Path == "/apisix/admin/oidc/callback" {
+ // 获取cookie，如果没有从apisix/admin/oidc/login页面顺着过来，不会有这个cookie，于是cookie.IsNew就为true，会返回403状态码
+ cookie, _ := conf.CookieStore.Get(c.Request, "oidc")
+ if cookie.IsNew {
+ c.AbortWithStatus(403)
+ }
+
+ //获取携带的授权码code
+ code := c.Query("code")
+ httpClient := new(http.Client)
+ var req *http.Request
+ var resp *http.Response
+ var err error
+
+ //访问authing指定api，用code换取access_token
+ redirectUrl := fmt.Sprintf("http://127.0.0.1:%d/apisix/admin/%s", conf.ServerPort, conf.OidcConf.RedirectUri)
Review Comment:
`127.0.0.1` should use `conf.ServerHost` instead.
##########
api/internal/filter/oidc.go:
##########
@@ -0,0 +1,126 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package filter
+
+import (
+ "encoding/json"
+ "fmt"
+ "github.com/apisix/manager-api/internal/conf"
+ "github.com/gin-gonic/gin"
+ "net/http"
+ "strings"
+)
+
+func Oidc() gin.HandlerFunc {
+ return func(c *gin.Context) {
+ if c.Request.URL.Path == "/apisix/admin/oidc/login" {
+ cookie, _ := conf.CookieStore.Get(c.Request, "oidc")
+ cookie.Save(c.Request, c.Writer)
+
+ // 携带必要的参数，跳转到authing的登录页面
+ redirectUrl := fmt.Sprintf("http://127.0.0.1:%d/apisix/admin/%s", conf.ServerPort, conf.OidcConf.RedirectUri)
+ url := "https://kjoenlkbhfkg-demo.authing.cn/oidc/auth?" +
+ fmt.Sprintf("client_id=%s&client_secret=%s&redirect_uri=%s",
+ conf.OidcConf.ClientId, conf.OidcConf.ClientSecret, redirectUrl) +
+ "&response_type=code&scope=openid&state=4756806&prompt=consent"
+ c.Redirect(302, url)
+ c.Abort()
+ return
+ }
+
+ if c.Request.URL.Path == "/apisix/admin/oidc/callback" {
+ // 获取cookie，如果没有从apisix/admin/oidc/login页面顺着过来，不会有这个cookie，于是cookie.IsNew就为true，会返回403状态码
+ cookie, _ := conf.CookieStore.Get(c.Request, "oidc")
+ if cookie.IsNew {
+ c.AbortWithStatus(403)
Review Comment:
Better to use `http.StatusForbidden` instead.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix-dashboard] nic-chen commented on a diff in pull request #2608: feat: Add login filter of OpenID-Connect Login
Posted by GitBox <gi...@apache.org>.
nic-chen commented on code in PR #2608:
URL: https://github.com/apache/apisix-dashboard/pull/2608#discussion_r1007500611
##########
api/internal/filter/authentication.go:
##########
@@ -29,53 +29,61 @@ import (
func Authentication() gin.HandlerFunc {
return func(c *gin.Context) {
- if c.Request.URL.Path == "/apisix/admin/user/login" ||
- c.Request.URL.Path == "/apisix/admin/tool/version" ||
- !strings.HasPrefix(c.Request.URL.Path, "/apisix") {
- c.Next()
- return
- }
-
- tokenStr := c.GetHeader("Authorization")
- // verify token
- token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
- return []byte(conf.AuthConf.Secret), nil
- })
-
+ cookie, _ := conf.CookieStore.Get(c.Request, "oidc")
errResp := gin.H{
"code": 010013,
"message": "request unauthorized",
}
- if err != nil || token == nil || !token.Valid {
- log.Warnf("token validate failed: %s", err)
- c.AbortWithStatusJSON(http.StatusUnauthorized, errResp)
- return
- }
+ if cookie.IsNew {
+ if c.Request.URL.Path == "/apisix/admin/user/login" ||
+ c.Request.URL.Path == "/apisix/admin/tool/version" ||
+ !strings.HasPrefix(c.Request.URL.Path, "/apisix") {
Review Comment:
we should put this block out of the block `if cookie.IsNew {`
##########
.github/workflows/backend-e2e-test.yml:
##########
@@ -44,6 +44,8 @@ jobs:
sed -i 's@127.0.0.1@0.0.0.0/0@' ./api/conf/conf.yaml
sed -i '/172.16.238.10:2379/a\ - 172.16.238.11:2379' ./api/conf/conf.yaml
sed -i '/172.16.238.10:2379/a\ - 172.16.238.12:2379' ./api/conf/conf.yaml
+ sed -i 's@0.0.0.0/0:9000@127.0.0.1:9000@' ./api/conf/conf.yaml
Review Comment:
Why amend here? Looks like it can only be accessed locally
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix-dashboard] ljzsmllx commented on a diff in pull request #2608: feat: Add login filter of OpenID-Connect Login
Posted by GitBox <gi...@apache.org>.
ljzsmllx commented on code in PR #2608:
URL: https://github.com/apache/apisix-dashboard/pull/2608#discussion_r1007809992
##########
api/internal/filter/authentication.go:
##########
@@ -17,11 +17,10 @@
package filter
import (
- "net/http"
- "strings"
-
"github.com/gin-gonic/gin"
"github.com/golang-jwt/jwt"
+ "net/http"
+ "strings"
Review Comment:
ok
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix-dashboard] starsz commented on a diff in pull request #2608: feat: Add login filter of OpenID-Connect Login
Posted by GitBox <gi...@apache.org>.
starsz commented on code in PR #2608:
URL: https://github.com/apache/apisix-dashboard/pull/2608#discussion_r1007809738
##########
api/internal/filter/authentication.go:
##########
@@ -17,11 +17,10 @@
package filter
import (
- "net/http"
- "strings"
-
"github.com/gin-gonic/gin"
"github.com/golang-jwt/jwt"
+ "net/http"
+ "strings"
Review Comment:
Code style.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix-dashboard] starsz commented on a diff in pull request #2608: feat: Add login filter of OpenID-Connect Login
Posted by GitBox <gi...@apache.org>.
starsz commented on code in PR #2608:
URL: https://github.com/apache/apisix-dashboard/pull/2608#discussion_r998991169
##########
api/internal/filter/oidc.go:
##########
@@ -0,0 +1,99 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package filter
+
+import (
+ "net/http"
+
+ "github.com/coreos/go-oidc/v3/oidc"
+ "github.com/gin-gonic/gin"
+ "golang.org/x/oauth2"
+
+ "github.com/apisix/manager-api/internal/conf"
+ "github.com/apisix/manager-api/internal/log"
+)
+
+type Token struct {
+ AccessToken string
+}
+
+func (token *Token) Token() (*oauth2.Token, error) {
+ oauth2Token := &oauth2.Token{AccessToken: token.AccessToken}
+ return oauth2Token, nil
+}
+
+func Oidc() gin.HandlerFunc {
+ return func(c *gin.Context) {
+ if c.Request.URL.Path == "/apisix/admin/oidc/login" {
+ url := conf.OidcConfig.AuthCodeURL(conf.State)
+ c.Redirect(302, url)
+ c.Abort()
+ return
+ }
+
+ if c.Request.URL.Path == "/apisix/admin/oidc/callback" {
+ state := c.Query("state")
+ if state != conf.State {
Review Comment:
Please add some log here.
##########
api/test/e2e/oidc/oidc_test.go:
##########
@@ -0,0 +1,227 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package oidc_test
+
+import (
+ "bytes"
+ "context"
+ "io/ioutil"
+ "math/rand"
+ "net/http"
+ "net/url"
+ "strings"
+ "time"
+
+ "github.com/Nerzal/gocloak/v11"
+ "github.com/PuerkitoBio/goquery"
+ "github.com/onsi/ginkgo"
+ "github.com/onsi/gomega"
+
+ "github.com/apisix/manager-api/test/e2e/base"
+)
+
+var _ = ginkgo.Describe("Oidc-Login", func() {
+ ginkgo.Context("test apisix/admin/oidc/login", func() {
+ ginkgo.It("should return status-code 302", func() {
+ gomega.Expect(accessOidcLogin()).To(gomega.Equal(http.StatusFound))
+ })
+ })
+ ginkgo.Context("test apisix/admin/oidc/callback", func() {
+ ginkgo.It("should return status-code 200", func() {
+ gomega.Expect(accessOidcCallback()).To(gomega.Equal(http.StatusOK))
+ })
+ })
+
+ ginkgo.Context("access apisix/admin/routes with cookie", func() {
+ ginkgo.It("should return status-code 200", func() {
+ gomega.Expect(accessRoutesWithCookie(true)).To(gomega.Equal(http.StatusOK))
+ })
+ })
+
+ ginkgo.Context("access apisix/admin/oidc/logout with cookie", func() {
+ ginkgo.It("should return status-code 200", func() {
+ gomega.Expect(accessOidcLogoutWithCookie(true)).To(gomega.Equal(http.StatusOK))
+ })
+ })
+
+ ginkgo.Context("access apisix/admin/routes with invalid cookie", func() {
+ ginkgo.It("should return status-code 401", func() {
+ gomega.Expect(accessRoutesWithCookie(false)).To(gomega.Equal(http.StatusUnauthorized))
+ })
+ })
+
+ ginkgo.Context("access apisix/admin/oidc/logout with invalid cookie", func() {
+ ginkgo.It("should return status-code 403", func() {
+ gomega.Expect(accessOidcLogoutWithCookie(false)).To(gomega.Equal(http.StatusForbidden))
+ })
+ })
+})
+
+func AccessOidcLogin() http.Response {
+ var req *http.Request
+ var resp *http.Response
+ var Client = &http.Client{
+ CheckRedirect: func(req *http.Request, via []*http.Request) error {
+ return http.ErrUseLastResponse
+ },
+ }
+
+ req, _ = http.NewRequest("GET", "http://127.0.0.1:9000/apisix/admin/oidc/login", nil)
+ resp, _ = Client.Do(req)
Review Comment:
Add check the error if `Client.Do`
##########
api/test/e2e/oidc/oidc_test.go:
##########
@@ -0,0 +1,227 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package oidc_test
+
+import (
+ "bytes"
+ "context"
+ "io/ioutil"
+ "math/rand"
+ "net/http"
+ "net/url"
+ "strings"
+ "time"
+
+ "github.com/Nerzal/gocloak/v11"
+ "github.com/PuerkitoBio/goquery"
+ "github.com/onsi/ginkgo"
+ "github.com/onsi/gomega"
+
+ "github.com/apisix/manager-api/test/e2e/base"
+)
+
+var _ = ginkgo.Describe("Oidc-Login", func() {
+ ginkgo.Context("test apisix/admin/oidc/login", func() {
+ ginkgo.It("should return status-code 302", func() {
+ gomega.Expect(accessOidcLogin()).To(gomega.Equal(http.StatusFound))
+ })
+ })
+ ginkgo.Context("test apisix/admin/oidc/callback", func() {
+ ginkgo.It("should return status-code 200", func() {
+ gomega.Expect(accessOidcCallback()).To(gomega.Equal(http.StatusOK))
+ })
+ })
+
+ ginkgo.Context("access apisix/admin/routes with cookie", func() {
+ ginkgo.It("should return status-code 200", func() {
+ gomega.Expect(accessRoutesWithCookie(true)).To(gomega.Equal(http.StatusOK))
+ })
+ })
+
+ ginkgo.Context("access apisix/admin/oidc/logout with cookie", func() {
+ ginkgo.It("should return status-code 200", func() {
+ gomega.Expect(accessOidcLogoutWithCookie(true)).To(gomega.Equal(http.StatusOK))
+ })
+ })
+
+ ginkgo.Context("access apisix/admin/routes with invalid cookie", func() {
+ ginkgo.It("should return status-code 401", func() {
+ gomega.Expect(accessRoutesWithCookie(false)).To(gomega.Equal(http.StatusUnauthorized))
+ })
+ })
+
+ ginkgo.Context("access apisix/admin/oidc/logout with invalid cookie", func() {
+ ginkgo.It("should return status-code 403", func() {
+ gomega.Expect(accessOidcLogoutWithCookie(false)).To(gomega.Equal(http.StatusForbidden))
+ })
+ })
+})
+
+func AccessOidcLogin() http.Response {
+ var req *http.Request
+ var resp *http.Response
+ var Client = &http.Client{
+ CheckRedirect: func(req *http.Request, via []*http.Request) error {
+ return http.ErrUseLastResponse
+ },
+ }
+
+ req, _ = http.NewRequest("GET", "http://127.0.0.1:9000/apisix/admin/oidc/login", nil)
+ resp, _ = Client.Do(req)
+
+ // return status-code
+ return *resp
+}
+
+func accessOidcLogin() int {
+ // access apisix/admin/oidc/login
+ resp := AccessOidcLogin()
+ return resp.StatusCode
+}
+
+func createUser(authenticationUrl string) string {
+ u, _ := url.Parse(authenticationUrl)
+ client := gocloak.NewClient("http://" + u.Host)
+ ctx := context.Background()
+ token, _ := client.LoginAdmin(ctx, "admin", "admin", "master")
+
+ username := GetRandomString(3)
+ user := gocloak.User{
+ FirstName: gocloak.StringP(GetRandomString(3)),
+ LastName: gocloak.StringP(GetRandomString(3)),
+ Email: gocloak.StringP(GetRandomString(3)),
+ Enabled: gocloak.BoolP(true),
+ Username: gocloak.StringP(username),
+ }
+
+ id, _ := client.CreateUser(ctx, token.AccessToken, "master", user)
+
+ _ = client.SetPassword(ctx, token.AccessToken, id, "master", "123456", false)
+ return username
+}
+
+func accessOidcCallback() int {
+ var authenticationUrl string
+ var loginUrl string
+ var req *http.Request
+ var resp *http.Response
+ var Client http.Client
+
+ // access apisix/admin/oidc/login to get the authentication-url
+ *resp = AccessOidcLogin()
+ authenticationUrl = resp.Header.Get("Location")
+
+ // create a user
+ username := createUser(authenticationUrl)
+
+ // access the authentication-url
+ req, _ = http.NewRequest("GET", authenticationUrl, nil)
+ resp, _ = Client.Do(req)
Review Comment:
```suggestion
resp, err = Client.Do(req)
```
gomega.Expect(err).ShouldNot(gomega.HaveOccurred(), "do request")
##########
api/test/e2e/oidc/oidc_test.go:
##########
@@ -0,0 +1,227 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package oidc_test
+
+import (
+ "bytes"
+ "context"
+ "io/ioutil"
+ "math/rand"
+ "net/http"
+ "net/url"
+ "strings"
+ "time"
+
+ "github.com/Nerzal/gocloak/v11"
+ "github.com/PuerkitoBio/goquery"
+ "github.com/onsi/ginkgo"
+ "github.com/onsi/gomega"
+
+ "github.com/apisix/manager-api/test/e2e/base"
+)
+
+var _ = ginkgo.Describe("Oidc-Login", func() {
+ ginkgo.Context("test apisix/admin/oidc/login", func() {
+ ginkgo.It("should return status-code 302", func() {
+ gomega.Expect(accessOidcLogin()).To(gomega.Equal(http.StatusFound))
+ })
+ })
+ ginkgo.Context("test apisix/admin/oidc/callback", func() {
+ ginkgo.It("should return status-code 200", func() {
+ gomega.Expect(accessOidcCallback()).To(gomega.Equal(http.StatusOK))
+ })
+ })
+
+ ginkgo.Context("access apisix/admin/routes with cookie", func() {
+ ginkgo.It("should return status-code 200", func() {
+ gomega.Expect(accessRoutesWithCookie(true)).To(gomega.Equal(http.StatusOK))
+ })
+ })
+
+ ginkgo.Context("access apisix/admin/oidc/logout with cookie", func() {
+ ginkgo.It("should return status-code 200", func() {
+ gomega.Expect(accessOidcLogoutWithCookie(true)).To(gomega.Equal(http.StatusOK))
+ })
+ })
+
+ ginkgo.Context("access apisix/admin/routes with invalid cookie", func() {
+ ginkgo.It("should return status-code 401", func() {
+ gomega.Expect(accessRoutesWithCookie(false)).To(gomega.Equal(http.StatusUnauthorized))
+ })
+ })
+
+ ginkgo.Context("access apisix/admin/oidc/logout with invalid cookie", func() {
+ ginkgo.It("should return status-code 403", func() {
+ gomega.Expect(accessOidcLogoutWithCookie(false)).To(gomega.Equal(http.StatusForbidden))
+ })
+ })
+})
+
+func AccessOidcLogin() http.Response {
+ var req *http.Request
+ var resp *http.Response
+ var Client = &http.Client{
Review Comment:
```suggestion
var client = &http.Client{
```
##########
api/test/e2e/oidc/oidc_test.go:
##########
@@ -0,0 +1,227 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package oidc_test
+
+import (
+ "bytes"
+ "context"
+ "io/ioutil"
+ "math/rand"
+ "net/http"
+ "net/url"
+ "strings"
+ "time"
+
+ "github.com/Nerzal/gocloak/v11"
+ "github.com/PuerkitoBio/goquery"
+ "github.com/onsi/ginkgo"
+ "github.com/onsi/gomega"
+
+ "github.com/apisix/manager-api/test/e2e/base"
+)
+
+var _ = ginkgo.Describe("Oidc-Login", func() {
+ ginkgo.Context("test apisix/admin/oidc/login", func() {
+ ginkgo.It("should return status-code 302", func() {
+ gomega.Expect(accessOidcLogin()).To(gomega.Equal(http.StatusFound))
+ })
+ })
+ ginkgo.Context("test apisix/admin/oidc/callback", func() {
+ ginkgo.It("should return status-code 200", func() {
+ gomega.Expect(accessOidcCallback()).To(gomega.Equal(http.StatusOK))
+ })
+ })
+
+ ginkgo.Context("access apisix/admin/routes with cookie", func() {
+ ginkgo.It("should return status-code 200", func() {
+ gomega.Expect(accessRoutesWithCookie(true)).To(gomega.Equal(http.StatusOK))
+ })
+ })
+
+ ginkgo.Context("access apisix/admin/oidc/logout with cookie", func() {
+ ginkgo.It("should return status-code 200", func() {
+ gomega.Expect(accessOidcLogoutWithCookie(true)).To(gomega.Equal(http.StatusOK))
+ })
+ })
+
+ ginkgo.Context("access apisix/admin/routes with invalid cookie", func() {
+ ginkgo.It("should return status-code 401", func() {
+ gomega.Expect(accessRoutesWithCookie(false)).To(gomega.Equal(http.StatusUnauthorized))
+ })
+ })
+
+ ginkgo.Context("access apisix/admin/oidc/logout with invalid cookie", func() {
+ ginkgo.It("should return status-code 403", func() {
+ gomega.Expect(accessOidcLogoutWithCookie(false)).To(gomega.Equal(http.StatusForbidden))
+ })
+ })
+})
+
+func AccessOidcLogin() http.Response {
+ var req *http.Request
+ var resp *http.Response
+ var Client = &http.Client{
+ CheckRedirect: func(req *http.Request, via []*http.Request) error {
+ return http.ErrUseLastResponse
+ },
+ }
+
+ req, _ = http.NewRequest("GET", "http://127.0.0.1:9000/apisix/admin/oidc/login", nil)
+ resp, _ = Client.Do(req)
Review Comment:
```suggestion
resp, _ = client.Do(req)
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix-dashboard] starsz commented on a diff in pull request #2608: feat: Add login filter of OpenID-Connect Login
Posted by GitBox <gi...@apache.org>.
starsz commented on code in PR #2608:
URL: https://github.com/apache/apisix-dashboard/pull/2608#discussion_r1007669441
##########
.github/workflows/backend-e2e-test.yml:
##########
@@ -44,6 +44,8 @@ jobs:
sed -i 's@127.0.0.1@0.0.0.0/0@' ./api/conf/conf.yaml
sed -i '/172.16.238.10:2379/a\ - 172.16.238.11:2379' ./api/conf/conf.yaml
sed -i '/172.16.238.10:2379/a\ - 172.16.238.12:2379' ./api/conf/conf.yaml
+ sed -i 's@0.0.0.0/0:9000@127.0.0.1:9000@' ./api/conf/conf.yaml
Review Comment:
Since the `sed -i 's@127.0.0.1@0.0.0.0/0@' ./api/conf/conf.yaml` command will change the original config
`redirect_url: http://127.0.0.1:9000/apisix/admin/oidc/callback` .
So this command is used to recover this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix-dashboard] ljzsmllx commented on a diff in pull request #2608: feat: Add login filter of OpenID-Connect Login
Posted by GitBox <gi...@apache.org>.
ljzsmllx commented on code in PR #2608:
URL: https://github.com/apache/apisix-dashboard/pull/2608#discussion_r1007642218
##########
api/internal/filter/authentication.go:
##########
@@ -29,53 +29,61 @@ import (
func Authentication() gin.HandlerFunc {
return func(c *gin.Context) {
- if c.Request.URL.Path == "/apisix/admin/user/login" ||
- c.Request.URL.Path == "/apisix/admin/tool/version" ||
- !strings.HasPrefix(c.Request.URL.Path, "/apisix") {
- c.Next()
- return
- }
-
- tokenStr := c.GetHeader("Authorization")
- // verify token
- token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
- return []byte(conf.AuthConf.Secret), nil
- })
-
+ cookie, _ := conf.CookieStore.Get(c.Request, "oidc")
errResp := gin.H{
"code": 010013,
"message": "request unauthorized",
}
- if err != nil || token == nil || !token.Valid {
- log.Warnf("token validate failed: %s", err)
- c.AbortWithStatusJSON(http.StatusUnauthorized, errResp)
- return
- }
+ if cookie.IsNew {
+ if c.Request.URL.Path == "/apisix/admin/user/login" ||
+ c.Request.URL.Path == "/apisix/admin/tool/version" ||
+ !strings.HasPrefix(c.Request.URL.Path, "/apisix") {
Review Comment:
ok
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix-dashboard] codecov-commenter commented on pull request #2608: feat: Add login filter of OpenID-Connect Login
Posted by GitBox <gi...@apache.org>.
codecov-commenter commented on PR #2608:
URL: https://github.com/apache/apisix-dashboard/pull/2608#issuecomment-1230029431
# [Codecov](https://codecov.io/gh/apache/apisix-dashboard/pull/2608?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) Report
> Merging [#2608](https://codecov.io/gh/apache/apisix-dashboard/pull/2608?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (eb04071) into [master](https://codecov.io/gh/apache/apisix-dashboard/commit/95566d5f5f818e02d8c8d9caf5f2ac90e1e603b5?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (95566d5) will **decrease** coverage by `17.66%`.
> The diff coverage is `23.00%`.
```diff
@@ Coverage Diff @@
## master #2608 +/- ##
===========================================
- Coverage 67.12% 49.45% -17.67%
===========================================
Files 178 47 -131
Lines 7172 3421 -3751
Branches 806 0 -806
===========================================
- Hits 4814 1692 -3122
+ Misses 2065 1526 -539
+ Partials 293 203 -90
```
| Flag | Coverage Δ | |
|---|---|---|
| backend-e2e-test-ginkgo | `?` | |
| backend-unit-test | `49.45% <23.00%> (-1.16%)` | :arrow_down: |
| frontend-e2e-test | `?` | |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#carryforward-flags-in-the-pull-request-comment) to find out more.
| [Impacted Files](https://codecov.io/gh/apache/apisix-dashboard/pull/2608?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) | Coverage Δ | |
|---|---|---|
| [api/internal/conf/conf.go](https://codecov.io/gh/apache/apisix-dashboard/pull/2608/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-YXBpL2ludGVybmFsL2NvbmYvY29uZi5nbw==) | `64.58% <ø> (ø)` | |
| [api/internal/filter/oidc.go](https://codecov.io/gh/apache/apisix-dashboard/pull/2608/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-YXBpL2ludGVybmFsL2ZpbHRlci9vaWRjLmdv) | `0.00% <0.00%> (ø)` | |
| [api/internal/filter/authentication.go](https://codecov.io/gh/apache/apisix-dashboard/pull/2608/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-YXBpL2ludGVybmFsL2ZpbHRlci9hdXRoZW50aWNhdGlvbi5nbw==) | `58.00% <55.31%> (-19.78%)` | :arrow_down: |
| [api/main.go](https://codecov.io/gh/apache/apisix-dashboard/pull/2608/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-YXBpL21haW4uZ28=) | `0.00% <0.00%> (-100.00%)` | :arrow_down: |
| [api/internal/utils/version.go](https://codecov.io/gh/apache/apisix-dashboard/pull/2608/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-YXBpL2ludGVybmFsL3V0aWxzL3ZlcnNpb24uZ28=) | `0.00% <0.00%> (-100.00%)` | :arrow_down: |
| [api/internal/filter/request\_id.go](https://codecov.io/gh/apache/apisix-dashboard/pull/2608/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-YXBpL2ludGVybmFsL2ZpbHRlci9yZXF1ZXN0X2lkLmdv) | `0.00% <0.00%> (-100.00%)` | :arrow_down: |
| [api/internal/core/entity/entity.go](https://codecov.io/gh/apache/apisix-dashboard/pull/2608/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-YXBpL2ludGVybmFsL2NvcmUvZW50aXR5L2VudGl0eS5nbw==) | `0.00% <0.00%> (-90.91%)` | :arrow_down: |
| [api/internal/core/store/storehub.go](https://codecov.io/gh/apache/apisix-dashboard/pull/2608/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-YXBpL2ludGVybmFsL2NvcmUvc3RvcmUvc3RvcmVodWIuZ28=) | `0.00% <0.00%> (-73.11%)` | :arrow_down: |
| [api/internal/filter/invalid\_request.go](https://codecov.io/gh/apache/apisix-dashboard/pull/2608/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-YXBpL2ludGVybmFsL2ZpbHRlci9pbnZhbGlkX3JlcXVlc3QuZ28=) | `28.57% <0.00%> (-71.43%)` | :arrow_down: |
| [api/internal/handler/proto/proto.go](https://codecov.io/gh/apache/apisix-dashboard/pull/2608/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-YXBpL2ludGVybmFsL2hhbmRsZXIvcHJvdG8vcHJvdG8uZ28=) | `0.00% <0.00%> (-67.26%)` | :arrow_down: |
| ... and [161 more](https://codecov.io/gh/apache/apisix-dashboard/pull/2608/diff?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) | |
:mega: We’re building smart automated test selection to slash your CI/CD build times. [Learn more](https://about.codecov.io/iterative-testing/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix-dashboard] starsz commented on a diff in pull request #2608: feat: Add login filter of OpenID-Connect Login
Posted by GitBox <gi...@apache.org>.
starsz commented on code in PR #2608:
URL: https://github.com/apache/apisix-dashboard/pull/2608#discussion_r970263917
##########
api/test/e2e/oidc/oidc_test.go:
##########
@@ -0,0 +1,75 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package oidc_test
+
+import (
+ "fmt"
+ "net/http"
+
+ "github.com/onsi/ginkgo"
+ "github.com/onsi/ginkgo/extensions/table"
+
+ "github.com/apisix/manager-api/test/e2e/base"
+)
+
+var _ = ginkgo.Describe("Oidc", func() {
+
+ table.DescribeTable("test oidc module",
+ func(tc base.HttpTestCase) {
+ base.RunTestCase(tc)
+ },
+
+ // apisix/admin/oidc/login
+ table.Entry("Access the oidc/login", base.HttpTestCase{
+ Object: base.ManagerApiExpect(),
+ Method: http.MethodGet,
+ Path: "/apisix/admin/oidc/login",
+ ExpectStatus: http.StatusOK,
+ }),
+
+ // apisix/admin/oidc/callback
+ table.Entry("Access with invalid state", base.HttpTestCase{
+ Object: base.ManagerApiExpect(),
+ Method: http.MethodGet,
+ Path: "/apisix/admin/oidc/callback",
+ Query: fmt.Sprintf("code=%s&state=%s", base.OidcCode, "invalid_state"),
+ ExpectStatus: http.StatusForbidden,
+ }),
+ table.Entry("Access with invalid authentication code, failed to fetch token", base.HttpTestCase{
+ Object: base.ManagerApiExpect(),
+ Method: http.MethodGet,
+ Path: "/apisix/admin/oidc/callback",
+ Query: fmt.Sprintf("code=%s&state=%s", "invalid_code", base.OidcState),
+ ExpectStatus: http.StatusForbidden,
+ }),
+ table.Entry("Access with valid authentication code, succeed to fetch user's id", base.HttpTestCase{
+ Object: base.ManagerApiExpect(),
+ Method: http.MethodGet,
+ Path: "/apisix/admin/oidc/callback",
+ Query: fmt.Sprintf("code=%s&state=%s", base.OidcCode, base.OidcState),
Review Comment:
What's the value of `OidcCode` ?
##########
api/test/e2e/oidc/oidc_test.go:
##########
@@ -0,0 +1,75 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package oidc_test
+
+import (
+ "fmt"
+ "net/http"
+
+ "github.com/onsi/ginkgo"
+ "github.com/onsi/ginkgo/extensions/table"
+
+ "github.com/apisix/manager-api/test/e2e/base"
+)
+
+var _ = ginkgo.Describe("Oidc", func() {
+
+ table.DescribeTable("test oidc module",
+ func(tc base.HttpTestCase) {
+ base.RunTestCase(tc)
+ },
+
+ // apisix/admin/oidc/login
+ table.Entry("Access the oidc/login", base.HttpTestCase{
+ Object: base.ManagerApiExpect(),
+ Method: http.MethodGet,
+ Path: "/apisix/admin/oidc/login",
+ ExpectStatus: http.StatusOK,
+ }),
+
+ // apisix/admin/oidc/callback
+ table.Entry("Access with invalid state", base.HttpTestCase{
+ Object: base.ManagerApiExpect(),
+ Method: http.MethodGet,
+ Path: "/apisix/admin/oidc/callback",
+ Query: fmt.Sprintf("code=%s&state=%s", base.OidcCode, "invalid_state"),
+ ExpectStatus: http.StatusForbidden,
+ }),
+ table.Entry("Access with invalid authentication code, failed to fetch token", base.HttpTestCase{
+ Object: base.ManagerApiExpect(),
+ Method: http.MethodGet,
+ Path: "/apisix/admin/oidc/callback",
+ Query: fmt.Sprintf("code=%s&state=%s", "invalid_code", base.OidcState),
+ ExpectStatus: http.StatusForbidden,
+ }),
+ table.Entry("Access with valid authentication code, succeed to fetch user's id", base.HttpTestCase{
+ Object: base.ManagerApiExpect(),
+ Method: http.MethodGet,
+ Path: "/apisix/admin/oidc/callback",
+ Query: fmt.Sprintf("code=%s&state=%s", base.OidcCode, base.OidcState),
+ ExpectStatus: http.StatusOK,
+ }),
+
+ // apisix/admin/oidc/logout
+ table.Entry("oidc logout", base.HttpTestCase{
+ Object: base.ManagerApiExpect(),
+ Method: http.MethodGet,
+ Path: "/apisix/admin/oidc/logout",
+ ExpectStatus: http.StatusOK,
+ }),
Review Comment:
We should request after the logout and test it return 302.
##########
api/test/e2e/oidc/oidc_test.go:
##########
@@ -0,0 +1,75 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package oidc_test
+
+import (
+ "fmt"
+ "net/http"
+
+ "github.com/onsi/ginkgo"
+ "github.com/onsi/ginkgo/extensions/table"
+
+ "github.com/apisix/manager-api/test/e2e/base"
+)
+
+var _ = ginkgo.Describe("Oidc", func() {
+
+ table.DescribeTable("test oidc module",
+ func(tc base.HttpTestCase) {
+ base.RunTestCase(tc)
+ },
+
+ // apisix/admin/oidc/login
+ table.Entry("Access the oidc/login", base.HttpTestCase{
+ Object: base.ManagerApiExpect(),
+ Method: http.MethodGet,
+ Path: "/apisix/admin/oidc/login",
+ ExpectStatus: http.StatusOK,
Review Comment:
And I think you should save the cookie， and request with the cookie in the later request.
##########
api/test/e2e/oidc/oidc_test.go:
##########
@@ -0,0 +1,75 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package oidc_test
+
+import (
+ "fmt"
+ "net/http"
+
+ "github.com/onsi/ginkgo"
+ "github.com/onsi/ginkgo/extensions/table"
+
+ "github.com/apisix/manager-api/test/e2e/base"
+)
+
+var _ = ginkgo.Describe("Oidc", func() {
+
+ table.DescribeTable("test oidc module",
+ func(tc base.HttpTestCase) {
+ base.RunTestCase(tc)
+ },
+
+ // apisix/admin/oidc/login
+ table.Entry("Access the oidc/login", base.HttpTestCase{
+ Object: base.ManagerApiExpect(),
+ Method: http.MethodGet,
+ Path: "/apisix/admin/oidc/login",
+ ExpectStatus: http.StatusOK,
Review Comment:
Why the status is `http.StatusOK `? I guess it should be 302.
##########
api/internal/filter/authentication_test.go:
##########
@@ -71,4 +82,12 @@ func TestAuthenticationMiddleware_Handle(t *testing.T) {
validToken := genToken("admin", time.Now().Unix(), time.Now().Unix()+60*3600)
w = performRequest(r, "GET", "/apisix/admin/routes", map[string]string{"Authorization": validToken})
assert.Equal(t, http.StatusOK, w.Code)
+
+ // test oidc auth with wrong cookie
+ w = performOidcRequest(r, "GET", "/apisix/admin/routes", "xxx")
+ assert.Equal(t, http.StatusUnauthorized, w.Code)
+
+ // test oidc auth success
+ w = performOidcRequest(r, "GET", "/apisix/admin/routes", conf.OidcId)
+ assert.Equal(t, http.StatusUnauthorized, w.Code)
Review Comment:
What's the reason that the oidc auth success but the code is `http.StatusUnauthorized`?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix-dashboard] starsz commented on a diff in pull request #2608: feat: Add login filter of OpenID-Connect Login
Posted by GitBox <gi...@apache.org>.
starsz commented on code in PR #2608:
URL: https://github.com/apache/apisix-dashboard/pull/2608#discussion_r964648711
##########
api/internal/filter/oidc_test.go:
##########
@@ -0,0 +1,49 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package filter
+
+import (
+ "fmt"
+ "github.com/apisix/manager-api/internal/conf"
+ "github.com/gin-gonic/gin"
Review Comment:
Code style.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix-dashboard] starsz merged pull request #2608: feat: Add login filter of OpenID-Connect Login
Posted by GitBox <gi...@apache.org>.
starsz merged PR #2608:
URL: https://github.com/apache/apisix-dashboard/pull/2608
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org