-
Notifications
You must be signed in to change notification settings - Fork 5.7k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix: override sub with federated_claims.user_id when dex is used (#20683
) Signed-off-by: Atif Ali <[email protected]> Signed-off-by: Alexandre Gaudreault <[email protected]> Co-authored-by: Alexandre Gaudreault <[email protected]>
- Loading branch information
1 parent
40d86e7
commit 85c6d26
Showing
13 changed files
with
405 additions
and
84 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -5,10 +5,12 @@ import ( | |
| "os" | ||
| "testing" | ||
|
|
||
| claimsutil "github.com/argoproj/argo-cd/v3/util/claims" | ||
| utils "github.com/argoproj/argo-cd/v3/util/io" | ||
|
|
||
| "github.com/golang-jwt/jwt/v5" | ||
| "github.com/stretchr/testify/assert" | ||
| "github.com/stretchr/testify/require" | ||
| ) | ||
|
|
||
| func captureStdout(callback func()) (string, error) { | ||
|
|
@@ -35,26 +37,45 @@ func captureStdout(callback func()) (string, error) { | |
| } | ||
|
|
||
| func Test_userDisplayName_email(t *testing.T) { | ||
| claims := jwt.MapClaims{"iss": "qux", "sub": "foo", "email": "[email protected]", "groups": []string{"baz"}} | ||
| claims, err := claimsutil.MapClaimsToArgoClaims(jwt.MapClaims{"iss": "qux", "sub": "foo", "email": "[email protected]", "groups": []string{"baz"}}) | ||
| require.NoError(t, err) | ||
| actualName := userDisplayName(claims) | ||
| expectedName := "[email protected]" | ||
| assert.Equal(t, expectedName, actualName) | ||
| } | ||
|
|
||
| func Test_userDisplayName_name(t *testing.T) { | ||
| claims := jwt.MapClaims{"iss": "qux", "sub": "foo", "name": "Firstname Lastname", "groups": []string{"baz"}} | ||
| claims, err := claimsutil.MapClaimsToArgoClaims(jwt.MapClaims{"iss": "qux", "sub": "foo", "name": "Firstname Lastname", "groups": []string{"baz"}}) | ||
| require.NoError(t, err) | ||
| actualName := userDisplayName(claims) | ||
| expectedName := "Firstname Lastname" | ||
| assert.Equal(t, expectedName, actualName) | ||
| } | ||
|
|
||
| func Test_userDisplayName_sub(t *testing.T) { | ||
| claims := jwt.MapClaims{"iss": "qux", "sub": "foo", "groups": []string{"baz"}} | ||
| claims, err := claimsutil.MapClaimsToArgoClaims(jwt.MapClaims{"iss": "qux", "sub": "foo", "groups": []string{"baz"}}) | ||
| require.NoError(t, err) | ||
| actualName := userDisplayName(claims) | ||
| expectedName := "foo" | ||
| assert.Equal(t, expectedName, actualName) | ||
| } | ||
|
|
||
| func Test_userDisplayName_federatedClaims(t *testing.T) { | ||
| claims, err := claimsutil.MapClaimsToArgoClaims(jwt.MapClaims{ | ||
| "iss": "qux", | ||
| "sub": "foo", | ||
| "groups": []string{"baz"}, | ||
| "federated_claims": map[string]any{ | ||
| "connector_id": "dex", | ||
| "user_id": "ldap-123", | ||
| }, | ||
| }) | ||
| require.NoError(t, err) | ||
| actualName := userDisplayName(claims) | ||
| expectedName := "ldap-123" | ||
| assert.Equal(t, expectedName, actualName) | ||
| } | ||
|
|
||
| func Test_ssoAuthFlow_ssoLaunchBrowser_false(t *testing.T) { | ||
| out, _ := captureStdout(func() { | ||
| ssoAuthFlow("http://test-sso-browser-flow.com", false) | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| package claims | ||
|
|
||
| import ( | ||
| "encoding/json" | ||
|
|
||
| "github.com/golang-jwt/jwt/v5" | ||
| ) | ||
|
|
||
| // ArgoClaims defines the claims structure based on Dex's documented claims | ||
| type ArgoClaims struct { | ||
| jwt.RegisteredClaims | ||
| Email string `json:"email,omitempty"` | ||
| EmailVerified bool `json:"email_verified,omitempty"` | ||
| Name string `json:"name,omitempty"` | ||
| Groups []string `json:"groups,omitempty"` | ||
| // As per Dex docs, federated_claims has a specific structure | ||
| FederatedClaims *FederatedClaims `json:"federated_claims,omitempty"` | ||
| } | ||
|
|
||
| // FederatedClaims represents the structure documented by Dex | ||
| type FederatedClaims struct { | ||
| ConnectorID string `json:"connector_id"` | ||
| UserID string `json:"user_id"` | ||
| } | ||
|
|
||
| // MapClaimsToArgoClaims converts a jwt.MapClaims to a ArgoClaims | ||
| func MapClaimsToArgoClaims(claims jwt.MapClaims) (*ArgoClaims, error) { | ||
| if claims == nil { | ||
| return &ArgoClaims{}, nil | ||
| } | ||
|
|
||
| claimsBytes, err := json.Marshal(claims) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| var argoClaims ArgoClaims | ||
| err = json.Unmarshal(claimsBytes, &argoClaims) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| return &argoClaims, nil | ||
| } | ||
|
|
||
| // GetUserIdentifier returns a consistent user identifier, checking federated_claims.user_id when Dex is in use | ||
| func (c *ArgoClaims) GetUserIdentifier() string { | ||
| // Check federated claims first | ||
| if c.FederatedClaims != nil && c.FederatedClaims.UserID != "" { | ||
| return c.FederatedClaims.UserID | ||
| } | ||
| // Fallback to sub | ||
| if c.Subject != "" { | ||
| return c.Subject | ||
| } | ||
| return "" | ||
| } |
Oops, something went wrong.