@@ -561,6 +561,171 @@ func TestAliasLookAhead(t *testing.T) {
561561 }
562562}
563563
564+ func TestLoginIssValidation (t * testing.T ) {
565+ b , storage := setupBackend (t , testNoPEMs , testName , testNamespace )
566+
567+ // test iss validation enabled with default "kubernetes/serviceaccount" issuer
568+ data := map [string ]interface {}{
569+ "kubernetes_host" : "host" ,
570+ "kubernetes_ca_cert" : testCACert ,
571+ "disable_iss_validation" : false ,
572+ }
573+
574+ req := & logical.Request {
575+ Operation : logical .CreateOperation ,
576+ Path : "config" ,
577+ Storage : storage ,
578+ Data : data ,
579+ }
580+
581+ resp , err := b .HandleRequest (context .Background (), req )
582+ if err != nil || (resp != nil && resp .IsError ()) {
583+ t .Fatalf ("err:%s resp:%#v\n " , err , resp )
584+ }
585+
586+ // test successful login with default issuer
587+ data = map [string ]interface {}{
588+ "role" : "plugin-test" ,
589+ "jwt" : jwtData ,
590+ }
591+
592+ req = & logical.Request {
593+ Operation : logical .UpdateOperation ,
594+ Path : "login" ,
595+ Storage : storage ,
596+ Data : data ,
597+ Connection : & logical.Connection {
598+ RemoteAddr : "127.0.0.1" ,
599+ },
600+ }
601+
602+ // test iss validation enabled with explicitly defined issuer
603+ data = map [string ]interface {}{
604+ "kubernetes_host" : "host" ,
605+ "kubernetes_ca_cert" : testCACert ,
606+ "disable_iss_validation" : false ,
607+ "issuer" : "kubernetes/serviceaccount" ,
608+ }
609+
610+ req = & logical.Request {
611+ Operation : logical .CreateOperation ,
612+ Path : "config" ,
613+ Storage : storage ,
614+ Data : data ,
615+ }
616+
617+ resp , err = b .HandleRequest (context .Background (), req )
618+ if err != nil || (resp != nil && resp .IsError ()) {
619+ t .Fatalf ("err:%s resp:%#v\n " , err , resp )
620+ }
621+
622+ // test successful login with explicitly defined issuer
623+ data = map [string ]interface {}{
624+ "role" : "plugin-test" ,
625+ "jwt" : jwtData ,
626+ }
627+
628+ req = & logical.Request {
629+ Operation : logical .UpdateOperation ,
630+ Path : "login" ,
631+ Storage : storage ,
632+ Data : data ,
633+ Connection : & logical.Connection {
634+ RemoteAddr : "127.0.0.1" ,
635+ },
636+ }
637+
638+ resp , err = b .HandleRequest (context .Background (), req )
639+ if err != nil || (resp != nil && resp .IsError ()) {
640+ t .Fatalf ("err:%s resp:%#v\n " , err , resp )
641+ }
642+
643+ // test iss validation enabled with custom issuer
644+ data = map [string ]interface {}{
645+ "kubernetes_host" : "host" ,
646+ "kubernetes_ca_cert" : testCACert ,
647+ "disable_iss_validation" : false ,
648+ "issuer" : "custom-issuer" ,
649+ }
650+
651+ req = & logical.Request {
652+ Operation : logical .CreateOperation ,
653+ Path : "config" ,
654+ Storage : storage ,
655+ Data : data ,
656+ }
657+
658+ resp , err = b .HandleRequest (context .Background (), req )
659+ if err != nil || (resp != nil && resp .IsError ()) {
660+ t .Fatalf ("err:%s resp:%#v\n " , err , resp )
661+ }
662+
663+ // test login fail with enabled iss validation and custom issuer
664+ data = map [string ]interface {}{
665+ "role" : "plugin-test" ,
666+ "jwt" : jwtData ,
667+ }
668+
669+ req = & logical.Request {
670+ Operation : logical .UpdateOperation ,
671+ Path : "login" ,
672+ Storage : storage ,
673+ Data : data ,
674+ Connection : & logical.Connection {
675+ RemoteAddr : "127.0.0.1" ,
676+ },
677+ }
678+
679+ resp , err = b .HandleRequest (context .Background (), req )
680+ if err == nil {
681+ t .Fatal ("expected error" )
682+ }
683+ if err .Error () != "claim \" iss\" is invalid" {
684+ t .Fatalf ("unexpected error: %s" , err )
685+ }
686+
687+ // test iss validation disabled with custom issuer
688+ data = map [string ]interface {}{
689+ "kubernetes_host" : "host" ,
690+ "kubernetes_ca_cert" : testCACert ,
691+ "disable_iss_validation" : true ,
692+ "issuer" : "custom-issuer" ,
693+ }
694+
695+ req = & logical.Request {
696+ Operation : logical .CreateOperation ,
697+ Path : "config" ,
698+ Storage : storage ,
699+ Data : data ,
700+ }
701+
702+ resp , err = b .HandleRequest (context .Background (), req )
703+ if err != nil || (resp != nil && resp .IsError ()) {
704+ t .Fatalf ("err:%s resp:%#v\n " , err , resp )
705+ }
706+
707+ // test login success with disabled iss validation and custom issuer
708+ data = map [string ]interface {}{
709+ "role" : "plugin-test" ,
710+ "jwt" : jwtData ,
711+ }
712+
713+ req = & logical.Request {
714+ Operation : logical .UpdateOperation ,
715+ Path : "login" ,
716+ Storage : storage ,
717+ Data : data ,
718+ Connection : & logical.Connection {
719+ RemoteAddr : "127.0.0.1" ,
720+ },
721+ }
722+
723+ resp , err = b .HandleRequest (context .Background (), req )
724+ if err != nil || (resp != nil && resp .IsError ()) {
725+ t .Fatalf ("err:%s resp:%#v\n " , err , resp )
726+ }
727+ }
728+
564729var jwtData = "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6InZhdWx0LWF1dGgtdG9rZW4tdDVwY24iLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoidmF1bHQtYXV0aCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6ImQ3N2Y4OWJjLTkwNTUtMTFlNy1hMDY4LTA4MDAyNzZkOTliZiIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDpkZWZhdWx0OnZhdWx0LWF1dGgifQ.HKUcqgrvan5ZC_mnpaMEx4RW3KrhfyH_u8G_IA2vUfkLK8tH3T7fJuJaPr7W6K_BqCrbeM5y3owszOzb4NR0Lvw6GBt2cFcen2x1Ua4Wokr0bJjTT7xQOIOw7UvUDyVS17wAurlfUnmWMwMMMOebpqj5K1t6GnyqghH1wPdHYRGX-q5a6C323dBCgM5t6JY_zTTaBgM6EkFq0poBaifmSMiJRPrdUN_-IgyK8fgQRiFYYkgS6DMIU4k4nUOb_sUFf5xb8vMs3SMteKiuWFAIt4iszXTj5IyBUNqe0cXA3zSY3QiNCV6bJ2CWW0Qf9WDtniT79VAqcR4GYaTC_gxjNA"
565730
566731var jwtBadServiceAccount = "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6InZhdWx0LWludmFsaWQtdG9rZW4tZ3ZxcHQiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoidmF1bHQtaW52YWxpZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjA0NGZkNGYxLTk3NGQtMTFlNy05YTE1LTA4MDAyNzZkOTliZiIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDpkZWZhdWx0OnZhdWx0LWludmFsaWQifQ.BcoOdu5BrIchp66Zl8-dY7HcGHJrVXrUh4SNTlIHR6vDaNH29B7JuI_-B1pvW9GpzQnc-XjZyua_wfSssqe-KYJcq--Qh0yQfbbLE5rvEipBCHH341IqGaTHaBVip8zXqYE-bt-7J6vAH8Azvw46iatDC73tKxh46xDuxK0gKjdprW4cOklDx6ZSxEHpu63ftLYgAgk9c0MUJxKWhu9Jk0aye5pTj_iyBbBy8llZNGaw2gxvhPzFVUEHZUlTRiSIbmPmNqep48RiJoWrq6FM1lijvrtT5y-E7aFk6TpW2BH3VDHy8k10sMIxuRAYrGB3tpUKNyVDI3tJOi_xY7iJvw"
0 commit comments