From c050c7290ca740f85bbdcf5a4cac66429185e838 Mon Sep 17 00:00:00 2001 From: polarathene <5098581+polarathene@users.noreply.github.com> Date: Fri, 19 Jan 2024 17:23:47 +1300 Subject: [PATCH] tests: OAuth2 - Minimize noise + Improve test assertion Caddyfile can use an Access Token instead of a JWT. Much smaller and correct for this OAuth2 configuration. This new value has been documented inline. Likewise the `sub` field returned is not important to this test. `email_verified` is kept as it may be helpful for further coverage testing. The actual test-case has better assertions for success and failure by checking for Dovecot logs we expect instead of netcat response. `oauth2` to `auth` for the Caddy container hostname is not necessary, just a more generic subdomain choice. --- test/config/oauth2/Caddyfile | 13 +++++++------ test/files/auth/imap-oauth2-auth.txt | 4 ++-- test/tests/serial/mail_with_oauth2.bats | 10 +++++++--- 3 files changed, 16 insertions(+), 11 deletions(-) diff --git a/test/config/oauth2/Caddyfile b/test/config/oauth2/Caddyfile index 5e3ebc58..68d059ce 100644 --- a/test/config/oauth2/Caddyfile +++ b/test/config/oauth2/Caddyfile @@ -3,6 +3,10 @@ # Dovecot will query the mocked `/userinfo` endpoint with the OAuth2 bearer token it was provided during login. # If the session for the token is valid, a response returns an attribute to perform a UserDB lookup on (default: email). +# `DMS_YWNjZXNzX3Rva2Vu` is the access token our OAuth2 tests expect for an authorization request to be successful. +# - The token was created by base64 encoding the string `access_token`, followed by adding `DMS_` as a prefix. +# - Normally an access token is a short-lived value associated to a login session. The value does not encode any real data. + :80 { # This is the `/userinfo` endpoint that Dovecot connects to with the OAuth2 setting (default: `introspection_mode = auth`). # Example: curl http://auth.example.test/userinfo -H 'Authorization: Bearer ' @@ -22,9 +26,7 @@ # /userinfo :2000 { - # OAuth2.0 Bearer token (paste into https://jwt.io/ to check it's contents). - # You should never need to edit this unless you REALLY need to change the issuer. - vars token "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwOi8vcHJvdmlkZXIuZXhhbXBsZS50ZXN0OjgwMDAvIiwic3ViIjoiODJjMWMzMzRkY2M2ZTMxMWFlNGFhZWJmZTk0NmM1ZTg1OGYwNTVhZmYxY2U1YTM3YWE3Y2M5MWFhYjE3ZTM1YyIsImF1ZCI6Im1haWxzZXJ2ZXIiLCJ1aWQiOiI4OU4zR0NuN1M1Y090WkZNRTVBeVhNbmxURFdVcnEzRmd4YWlyWWhFIn0.zuCytArbphhJn9XT_y9cBdGqDCNo68tBrtOwPIsuKNyF340SaOuZa0xarZofygytdDpLtYr56QlPTKImi-n1ZWrHkRZkwrQi5jQ-j_n2hEAL0vUToLbDnXYfc5q2w7z7X0aoCmiK8-fV7Kx4CVTM7riBgpElf6F3wNAIcX6R1ijUh6ISCL0XYsdogf8WUNZipXY-O4R7YHXdOENuOp3G48hWhxuUh9PsUqE5yxDwLsOVzCTqg9S5gxPQzF2eCN9J0I2XiIlLKvLQPIZ2Y_K7iYvVwjpNdgb4xhm9wuKoIVinYkF_6CwIzAawBWIDJAbix1IslkUPQMGbupTDtOgTiQ" + vars token "DMS_YWNjZXNzX3Rva2Vu" # Expects to match an authorization header with a specific bearer token: # https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication#authentication_schemes @@ -38,8 +40,7 @@ respond <, method=XOAUTH2' }