Function TestAzureAKPKIWithCoderd

coderd/oauthpki/okidcpki_test.go:133–183

TestAzureAKPKIWithCoderd uses a fake IDP and a real Coderd to test PKI auth. nolint:bodyclose

(t *testing.T)

// TestAzureAKPKIWithCoderd uses a fake IDP and a real Coderd to test PKI auth.
// nolint:bodyclose
func TestAzureAKPKIWithCoderd(t *testing.T) {
	t.Parallel()

	scopes := []string{"openid", "email", "profile", "offline_access"}
	fake := oidctest.NewFakeIDP(t,
		oidctest.WithIssuer("https://login.microsoftonline.com/fake_app"),
		oidctest.WithCustomClientAuth(func(t testing.TB, req *http.Request) (url.Values, error) {
			values := assertJWTAuth(t, req)
			if values == nil {
				return nil, xerrors.New("authorizatin failed in request")
			}
			return values, nil
		}),
		oidctest.WithServing(),
		oidctest.WithLogging(t, nil),
	)
	cfg := fake.OIDCConfig(t, scopes, func(cfg *coderd.OIDCConfig) {
		cfg.AllowSignups = true
	})

	oauthCfg := cfg.OAuth2Config.(*oauth2.Config)
	// Create the oauthpki config
	pki, err := oauthpki.NewOauth2PKIConfig(oauthpki.ConfigParams{
		ClientID:       oauthCfg.ClientID,
		TokenURL:       oauthCfg.Endpoint.TokenURL,
		Scopes:         scopes,
		PemEncodedKey:  []byte(testClientKey),
		PemEncodedCert: []byte(testClientCert),
		Config:         oauthCfg,
	})
	require.NoError(t, err)
	cfg.OAuth2Config = pki

	owner, _, api := coderdtest.NewWithAPI(t, &coderdtest.Options{
		OIDCConfig: cfg,
	})

	// Create a user and login
	const email = "alice@coder.com"
	claims := jwt.MapClaims{
		"email": email,
		"sub":   uuid.NewString(),
	}
	helper := oidctest.NewLoginHelper(owner, fake)
	user, _ := helper.Login(t, claims)

	// Try refreshing the token more than once.
	for i := 0; i < 2; i++ {
		helper.ForceRefresh(t, api.Database, user, claims)
	}
}

// TestSavedAzureADPKIOIDC was created by capturing actual responses from an Azure
// AD instance and saving them to replay, removing some details.