349 lines
12 KiB
Ruby
349 lines
12 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
require 'spec_helper'
|
|
|
|
RSpec.describe JwtController, feature_category: :system_access do
|
|
include_context 'parsed logs'
|
|
|
|
let(:service) { double(execute: {} ) }
|
|
let(:service_class) { Auth::ContainerRegistryAuthenticationService }
|
|
let(:service_name) { 'container_registry' }
|
|
let(:parameters) { { service: service_name } }
|
|
|
|
before do
|
|
allow(service_class).to receive(:new).and_return(service)
|
|
end
|
|
|
|
shared_examples 'user logging' do
|
|
it 'logs username and ID' do
|
|
expect(log_data['username']).to eq(user.username)
|
|
expect(log_data['user_id']).to eq(user.id)
|
|
expect(log_data['meta.user']).to eq(user.username)
|
|
end
|
|
end
|
|
|
|
shared_examples 'a token that expires today' do
|
|
let(:pat) { create(:personal_access_token, user: user, scopes: ['api'], expires_at: Date.today ) }
|
|
let(:headers) { { authorization: credentials('personal_access_token', pat.token) } }
|
|
|
|
it 'fails authentication' do
|
|
expect(::Gitlab::AuthLogger).to receive(:warn).with(
|
|
hash_including(message: 'JWT authentication failed',
|
|
http_user: 'personal_access_token')).and_call_original
|
|
|
|
get '/jwt/auth', params: parameters, headers: headers
|
|
|
|
expect(response).to have_gitlab_http_status(:unauthorized)
|
|
end
|
|
end
|
|
|
|
shared_examples "with invalid credentials" do
|
|
it "returns a generic error message" do
|
|
subject
|
|
|
|
expect(response).to have_gitlab_http_status(:unauthorized)
|
|
expect(json_response).to eq(
|
|
{
|
|
"errors" => [{
|
|
"code" => "UNAUTHORIZED",
|
|
"message" => "HTTP Basic: Access denied. The provided password or token is incorrect or your account has 2FA enabled and you must use a personal access token instead of a password. See http://www.example.com/help/user/profile/account/two_factor_authentication#troubleshooting"
|
|
}]
|
|
}
|
|
)
|
|
end
|
|
end
|
|
|
|
context 'POST /jwt/auth' do
|
|
it 'returns 404' do
|
|
post '/jwt/auth'
|
|
|
|
expect(response).to have_gitlab_http_status(:not_found)
|
|
end
|
|
end
|
|
|
|
context 'authenticating against container registry' do
|
|
context 'existing service' do
|
|
subject! { get '/jwt/auth', params: parameters }
|
|
|
|
it { expect(response).to have_gitlab_http_status(:ok) }
|
|
|
|
context 'returning custom http code' do
|
|
let(:service) { double(execute: { http_status: 505 }) }
|
|
|
|
it { expect(response).to have_gitlab_http_status(:http_version_not_supported) }
|
|
end
|
|
end
|
|
|
|
context 'when using authenticated request' do
|
|
shared_examples 'rejecting a blocked user' do
|
|
context 'with blocked user' do
|
|
let(:user) { create(:user, :blocked) }
|
|
|
|
it_behaves_like 'with invalid credentials'
|
|
end
|
|
end
|
|
|
|
context 'using CI token' do
|
|
let(:user) { create(:user) }
|
|
let(:build) { create(:ci_build, :running, user: user) }
|
|
let(:project) { build.project }
|
|
let(:headers) { { authorization: credentials('gitlab-ci-token', build.token) } }
|
|
|
|
context 'project with enabled CI' do
|
|
subject! { get '/jwt/auth', params: parameters, headers: headers }
|
|
|
|
it { expect(service_class).to have_received(:new).with(project, user, ActionController::Parameters.new(parameters.merge(auth_type: :build)).permit!) }
|
|
|
|
it_behaves_like 'user logging'
|
|
end
|
|
|
|
context 'project with disabled CI' do
|
|
before do
|
|
project.project_feature.update_attribute(:builds_access_level, ProjectFeature::DISABLED)
|
|
end
|
|
|
|
subject! { get '/jwt/auth', params: parameters, headers: headers }
|
|
|
|
it { expect(response).to have_gitlab_http_status(:unauthorized) }
|
|
end
|
|
|
|
context 'using deploy tokens' do
|
|
let(:deploy_token) { create(:deploy_token, read_registry: true, projects: [project]) }
|
|
let(:headers) { { authorization: credentials(deploy_token.username, deploy_token.token) } }
|
|
|
|
subject! { get '/jwt/auth', params: parameters, headers: headers }
|
|
|
|
it 'authenticates correctly' do
|
|
expect(response).to have_gitlab_http_status(:ok)
|
|
expect(service_class).to have_received(:new)
|
|
.with(
|
|
nil,
|
|
nil,
|
|
ActionController::Parameters.new(parameters.merge(deploy_token: deploy_token, auth_type: :deploy_token)).permit!
|
|
)
|
|
end
|
|
|
|
it 'does not log a user' do
|
|
expect(log_data.keys).not_to include(%w(username user_id))
|
|
end
|
|
end
|
|
|
|
context 'using personal access tokens' do
|
|
let(:pat) { create(:personal_access_token, user: user, scopes: ['read_registry']) }
|
|
let(:headers) { { authorization: credentials('personal_access_token', pat.token) } }
|
|
|
|
before do
|
|
stub_container_registry_config(enabled: true)
|
|
end
|
|
|
|
subject! { get '/jwt/auth', params: parameters, headers: headers }
|
|
|
|
it 'authenticates correctly' do
|
|
expect(response).to have_gitlab_http_status(:ok)
|
|
expect(service_class).to have_received(:new)
|
|
.with(
|
|
nil,
|
|
user,
|
|
ActionController::Parameters.new(parameters.merge(auth_type: :personal_access_token)).permit!
|
|
)
|
|
end
|
|
|
|
it_behaves_like 'rejecting a blocked user'
|
|
it_behaves_like 'user logging'
|
|
it_behaves_like 'a token that expires today'
|
|
end
|
|
end
|
|
|
|
context 'using User login' do
|
|
let(:user) { create(:user) }
|
|
let(:headers) { { authorization: credentials(user.username, user.password) } }
|
|
|
|
subject! { get '/jwt/auth', params: parameters, headers: headers }
|
|
|
|
it { expect(service_class).to have_received(:new).with(nil, user, ActionController::Parameters.new(parameters.merge(auth_type: :gitlab_or_ldap)).permit!) }
|
|
|
|
it_behaves_like 'rejecting a blocked user'
|
|
|
|
context 'when passing a flat array of scopes' do
|
|
# We use this trick to make rails to generate a query_string:
|
|
# scope=scope1&scope=scope2
|
|
# It works because :scope and 'scope' are the same as string, but different objects
|
|
let(:parameters) do
|
|
{
|
|
:service => service_name,
|
|
:scope => 'scope1',
|
|
'scope' => 'scope2'
|
|
}
|
|
end
|
|
|
|
let(:service_parameters) do
|
|
ActionController::Parameters.new({ service: service_name, scopes: %w(scope1 scope2) }).permit!
|
|
end
|
|
|
|
it { expect(service_class).to have_received(:new).with(nil, user, service_parameters.merge(auth_type: :gitlab_or_ldap)) }
|
|
|
|
it_behaves_like 'user logging'
|
|
end
|
|
|
|
context 'when user has 2FA enabled' do
|
|
let(:user) { create(:user, :two_factor) }
|
|
|
|
context 'without personal token' do
|
|
it_behaves_like 'with invalid credentials'
|
|
end
|
|
|
|
context 'with personal token' do
|
|
let(:access_token) { create(:personal_access_token, user: user) }
|
|
let(:headers) { { authorization: credentials(user.username, access_token.token) } }
|
|
|
|
it 'accepts the authorization attempt' do
|
|
expect(response).to have_gitlab_http_status(:ok)
|
|
end
|
|
end
|
|
end
|
|
|
|
it 'does not cause session based checks to be activated' do
|
|
expect(Gitlab::Session).not_to receive(:with_session)
|
|
|
|
get '/jwt/auth', params: parameters, headers: headers
|
|
|
|
expect(response).to have_gitlab_http_status(:ok)
|
|
end
|
|
end
|
|
|
|
context 'using invalid login' do
|
|
let(:headers) { { authorization: credentials('invalid', 'password') } }
|
|
let(:subject) { get '/jwt/auth', params: parameters, headers: headers }
|
|
|
|
context 'when internal auth is enabled' do
|
|
it_behaves_like 'with invalid credentials'
|
|
end
|
|
|
|
context 'when internal auth is disabled' do
|
|
before do
|
|
stub_application_setting(password_authentication_enabled_for_git: false)
|
|
end
|
|
|
|
it_behaves_like 'with invalid credentials'
|
|
end
|
|
end
|
|
end
|
|
|
|
context 'when using unauthenticated request' do
|
|
it 'accepts the authorization attempt' do
|
|
get '/jwt/auth', params: parameters
|
|
|
|
expect(response).to have_gitlab_http_status(:ok)
|
|
end
|
|
|
|
it 'allows read access' do
|
|
expect(service).to receive(:execute).with(authentication_abilities: Gitlab::Auth.read_only_authentication_abilities)
|
|
|
|
get '/jwt/auth', params: parameters
|
|
end
|
|
end
|
|
|
|
context 'unknown service' do
|
|
subject! { get '/jwt/auth', params: { service: 'unknown' } }
|
|
|
|
it { expect(response).to have_gitlab_http_status(:not_found) }
|
|
end
|
|
|
|
def credentials(login, password)
|
|
ActionController::HttpAuthentication::Basic.encode_credentials(login, password)
|
|
end
|
|
end
|
|
|
|
context 'authenticating against dependency proxy' do
|
|
let_it_be(:user) { create(:user) }
|
|
let_it_be(:personal_access_token) { create(:personal_access_token, user: user) }
|
|
let_it_be(:group) { create(:group) }
|
|
let_it_be(:project) { create(:project, :private, group: group) }
|
|
let_it_be(:group_deploy_token) { create(:deploy_token, :group, :dependency_proxy_scopes) }
|
|
let_it_be(:gdeploy_token) { create(:group_deploy_token, deploy_token: group_deploy_token, group: group) }
|
|
let_it_be(:project_deploy_token) { create(:deploy_token, :project, :dependency_proxy_scopes) }
|
|
let_it_be(:pdeploy_token) { create(:project_deploy_token, deploy_token: project_deploy_token, project: project) }
|
|
let_it_be(:service_name) { 'dependency_proxy' }
|
|
|
|
let(:headers) { { authorization: credentials(credential_user, credential_password) } }
|
|
let(:params) { { account: credential_user, client_id: 'docker', offline_token: true, service: service_name } }
|
|
|
|
before do
|
|
stub_config(dependency_proxy: { enabled: true })
|
|
end
|
|
|
|
subject { get '/jwt/auth', params: params, headers: headers }
|
|
|
|
shared_examples 'with valid credentials' do
|
|
it 'returns token successfully' do
|
|
subject
|
|
|
|
expect(response).to have_gitlab_http_status(:success)
|
|
expect(json_response['token']).to be_present
|
|
end
|
|
end
|
|
|
|
context 'with personal access token' do
|
|
let(:credential_user) { nil }
|
|
let(:credential_password) { personal_access_token.token }
|
|
|
|
it_behaves_like 'with valid credentials'
|
|
it_behaves_like 'a token that expires today'
|
|
end
|
|
|
|
context 'with user credentials token' do
|
|
let(:credential_user) { user.username }
|
|
let(:credential_password) { user.password }
|
|
|
|
it_behaves_like 'with valid credentials'
|
|
end
|
|
|
|
context 'with group deploy token' do
|
|
let(:credential_user) { group_deploy_token.username }
|
|
let(:credential_password) { group_deploy_token.token }
|
|
|
|
it_behaves_like 'with valid credentials'
|
|
end
|
|
|
|
context 'with project deploy token' do
|
|
let(:credential_user) { project_deploy_token.username }
|
|
let(:credential_password) { project_deploy_token.token }
|
|
|
|
it_behaves_like 'returning response status', :forbidden
|
|
end
|
|
|
|
context 'with revoked group deploy token' do
|
|
let(:credential_user) { group_deploy_token.username }
|
|
let(:credential_password) { project_deploy_token.token }
|
|
|
|
before do
|
|
group_deploy_token.update_column(:revoked, true)
|
|
end
|
|
|
|
it_behaves_like 'returning response status', :unauthorized
|
|
end
|
|
|
|
context 'with group deploy token with insufficient scopes' do
|
|
let(:credential_user) { group_deploy_token.username }
|
|
let(:credential_password) { project_deploy_token.token }
|
|
|
|
before do
|
|
group_deploy_token.update_column(:write_registry, false)
|
|
end
|
|
|
|
it_behaves_like 'returning response status', :unauthorized
|
|
end
|
|
|
|
context 'with invalid credentials' do
|
|
let(:credential_user) { 'foo' }
|
|
let(:credential_password) { 'bar' }
|
|
|
|
it_behaves_like 'returning response status', :unauthorized
|
|
end
|
|
end
|
|
|
|
def credentials(login, password)
|
|
ActionController::HttpAuthentication::Basic.encode_credentials(login, password)
|
|
end
|
|
end
|