{% block content %}{% endblock %}
You have been successfully logged out.
-Log in again.
++{% if oidc_enabled and 'remote_user' in request.GET %} + +{% else %} + +{% endif %} +Log in again.
{% endblock %} diff --git a/swh/web/tests/auth/__init__.py b/swh/web/tests/auth/__init__.py new file mode 100644 index 00000000..e69de29b diff --git a/swh/web/tests/auth/keycloak_mock.py b/swh/web/tests/auth/keycloak_mock.py new file mode 100644 index 00000000..9252b398 --- /dev/null +++ b/swh/web/tests/auth/keycloak_mock.py @@ -0,0 +1,77 @@ +# Copyright (C) 2020 The Software Heritage developers +# See the AUTHORS file at the top-level directory of this distribution +# License: GNU Affero General Public License version 3, or any later version +# See top-level LICENSE file for more information + +from copy import copy +from unittest.mock import Mock + +from django.conf import settings +from django.utils import timezone + +from swh.web.auth.keycloak import KeycloakOpenIDConnect +from swh.web.config import get_config + +from .sample_data import oidc_profile, realm_public_key, userinfo + + +class KeycloackOpenIDConnectMock(KeycloakOpenIDConnect): + + def __init__(self, auth_success=True): + swhweb_config = get_config() + super().__init__(swhweb_config['keycloak']['server_url'], + swhweb_config['keycloak']['realm_name'], + settings.OIDC_SWH_WEB_CLIENT_ID) + self._keycloak.public_key = lambda: realm_public_key + self._keycloak.well_know = lambda: { + 'issuer': f'{self.server_url}realms/{self.realm_name}', + 'authorization_endpoint': (f'{self.server_url}realms/' + f'{self.realm_name}/protocol/' + 'openid-connect/auth'), + 'token_endpoint': (f'{self.server_url}realms/{self.realm_name}/' + 'protocol/openid-connect/token'), + 'token_introspection_endpoint': (f'{self.server_url}realms/' + f'{self.realm_name}/protocol/' + 'openid-connect/token/' + 'introspect'), + 'userinfo_endpoint': (f'{self.server_url}realms/{self.realm_name}/' + 'protocol/openid-connect/userinfo'), + 'end_session_endpoint': (f'{self.server_url}realms/' + f'{self.realm_name}/protocol/' + 'openid-connect/logout'), + 'jwks_uri': (f'{self.server_url}realms/{self.realm_name}/' + 'protocol/openid-connect/certs'), + } + self.authorization_code = Mock() + self.userinfo = Mock() + self.logout = Mock() + if auth_success: + self.authorization_code.return_value = copy(oidc_profile) + self.userinfo.return_value = copy(userinfo) + else: + self.authorization_url = Mock() + exception = Exception('Authentication failed') + self.authorization_code.side_effect = exception + self.authorization_url.side_effect = exception + self.userinfo.side_effect = exception + self.logout.side_effect = exception + + def decode_token(self, token): + # skip signature expiration check as we use a static oidc_profile + # for the tests with expired tokens in it + options = {'verify_exp': False} + decoded = super().decode_token(token, options) + # tweak auth and exp time for tests + expire_in = decoded['exp'] - decoded['auth_time'] + decoded['auth_time'] = int(timezone.now().timestamp()) + decoded['exp'] = decoded['auth_time'] + expire_in + return decoded + + +def mock_keycloak(mocker, auth_success=True): + kc_oidc_mock = KeycloackOpenIDConnectMock(auth_success) + mock_get_oidc_client = mocker.patch( + 'swh.web.auth.views.get_oidc_client') + mock_get_oidc_client.return_value = kc_oidc_mock + mocker.patch('swh.web.auth.backends._oidc_client', kc_oidc_mock) + return kc_oidc_mock diff --git a/swh/web/tests/auth/sample_data.py b/swh/web/tests/auth/sample_data.py new file mode 100644 index 00000000..604bae28 --- /dev/null +++ b/swh/web/tests/auth/sample_data.py @@ -0,0 +1,95 @@ +# Copyright (C) 2020 The Software Heritage developers +# See the AUTHORS file at the top-level directory of this distribution +# License: GNU Affero General Public License version 3, or any later version +# See top-level LICENSE file for more information + + +realm_public_key = ( + 'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnqF4xvGjaI54P6WtJvyGayxP8A93u' + 'NcA3TH6jitwmyAalj8dN8/NzK9vrdlSA3Ibvp/XQujPSOP7a35YiYFscEJnogTXQpE/FhZrUY' + 'y21U6ezruVUv4z/ER1cYLb+q5ZI86nXSTNCAbH+lw7rQjlvcJ9KvgHEeA5ALXJ1r55zUmNvuy' + '5o6ke1G3fXbNSXwF4qlWAzo1o7Ms8qNrNyOG8FPx24dvm9xMH7/08IPvh9KUqlnP8h6olpxHr' + 'drX/q4E+Nzj8Tr8p7Z5CimInls40QuOTIhs6C2SwFHUgQgXl9hB9umiZJlwYEpDv0/LO2zYie' + 'Hl5Lv7Iig4FOIXIVCaDGQIDAQAB' +) + +oidc_profile = { + 'access_token': ('eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJPSnhV' + 'Q0p0TmJQT0NOUGFNNmc3ZU1zY2pqTXhoem9vNGxZaFhsa1c2TWhBIn0.' + 'eyJqdGkiOiIzMWZjNTBiNy1iYmU1LTRmNTEtOTFlZi04ZTNlZWM1MTMz' + 'MWUiLCJleHAiOjE1ODI3MjM3MDEsIm5iZiI6MCwiaWF0IjoxNTgyNzIz' + 'MTAxLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFs' + 'bXMvU29mdHdhcmVIZXJpdGFnZSIsImF1ZCI6WyJzd2gtd2ViIiwiYWNj' + 'b3VudCJdLCJzdWIiOiJmZWFjZDM0NC1iNDY4LTRhNjUtYTIzNi0xNGY2' + 'MWU2YjcyMDAiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJzd2gtd2ViIiwi' + 'YXV0aF90aW1lIjoxNTgyNzIzMTAwLCJzZXNzaW9uX3N0YXRlIjoiZDgy' + 'YjkwZDEtMGE5NC00ZTc0LWFkNjYtZGQ5NTM0MWM3YjZkIiwiYWNyIjoi' + 'MSIsImFsbG93ZWQtb3JpZ2lucyI6WyIqIl0sInJlYWxtX2FjY2VzcyI6' + 'eyJyb2xlcyI6WyJvZmZsaW5lX2FjY2VzcyIsInVtYV9hdXRob3JpemF0' + 'aW9uIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsiYWNjb3VudCI6eyJyb2xl' + 'cyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtz' + 'Iiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJvcGVuaWQgZW1haWwg' + 'cHJvZmlsZSIsImVtYWlsX3ZlcmlmaWVkIjpmYWxzZSwibmFtZSI6Ikpv' + 'aG4gRG9lIiwiZ3JvdXBzIjpbXSwicHJlZmVycmVkX3VzZXJuYW1lIjoi' + 'am9obmRvZSIsImdpdmVuX25hbWUiOiJKb2huIiwiZmFtaWx5X25hbWUi' + 'OiJEb2UiLCJlbWFpbCI6ImpvaG4uZG9lQGV4YW1wbGUuY29tIn0.neJ-' + 'Pmd87J6Gt0fzDqmXFeoy34Iqb5vNNEEgIKqtqg3moaVkbXrO_9R37DJB' + 'AgdFv0owVONK3GbqPOEICePgG6RFtri999DetNE-O5sB4fwmHPWcHPlO' + 'kcPLbVJqu6zWo-2AzlfAy5bCNvj_wzs2tjFjLeHcRgR1a1WY3uTp5EWc' + 'HITCWQZzZWFGZTZCTlGkpdyJTqxGBdSHRB4NlIVGpYSTBsBsxttFEetl' + 'rpcNd4-5AteFprIr9hn9VasIIF8WdFdtC2e8xGMJW5Q0M3G3Iu-LLNmE' + 'oTIDqtbJ7OrIcGBIwsc3seCV3eCG6kOYwz5w-f8DeOpwcDX58yYPmapJ' + '6A'), + 'expires_in': 600, + 'id_token': ('eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJPSnhVQ0p0' + 'TmJQT0NOUGFNNmc3ZU1zY2pqTXhoem9vNGxZaFhsa1c2TWhBIn0.eyJqdGki' + 'OiI0NDRlYzU1My1iYzhiLTQ2YjYtOTlmYS0zOTc3YTJhZDY1ZmEiLCJleHAi' + 'OjE1ODI3MjM3MDEsIm5iZiI6MCwiaWF0IjoxNTgyNzIzMTAxLCJpc3MiOiJo' + 'dHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMvU29mdHdhcmVIZXJp' + 'dGFnZSIsImF1ZCI6InN3aC13ZWIiLCJzdWIiOiJmZWFjZDM0NC1iNDY4LTRh' + 'NjUtYTIzNi0xNGY2MWU2YjcyMDAiLCJ0eXAiOiJJRCIsImF6cCI6InN3aC13' + 'ZWIiLCJhdXRoX3RpbWUiOjE1ODI3MjMxMDAsInNlc3Npb25fc3RhdGUiOiJk' + 'ODJiOTBkMS0wYTk0LTRlNzQtYWQ2Ni1kZDk1MzQxYzdiNmQiLCJhY3IiOiIx' + 'IiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJuYW1lIjoiSm9obiBEb2UiLCJn' + 'cm91cHMiOltdLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJqb2huZG9lIiwiZ2l2' + 'ZW5fbmFtZSI6IkpvaG4iLCJmYW1pbHlfbmFtZSI6IkRvZSIsImVtYWlsIjoi' + 'am9obi5kb2VAZXhhbXBsZS5jb20ifQ.YB7bxlz_wgLJSkylVjmqedxQgEMee' + 'JOdi9CFHXV4F3ZWsEZ52CGuJXsozkX2oXvgU06MzzLNEK8ojgrPSNzjRkutL' + 'aaLq_YUzv4iV8fmKUS_aEyiYZbfoBe3Y4dwv2FoPEPCt96iTwpzM5fg_oYw_' + 'PHCq-Yl5SulT1nTrJZpntkf0hRjmxlDO06JMp0aZ8xS8RYJqH48xCRf_DARE' + '0jJV2-UuzOWI6xBATwFfP44kV6wFmErLN5txMgwZzCSB2OCe5Cl1il0eTQTN' + 'ybeSYZeZE61QtuTRUHeP1D1qSbJGy5g_S67SdTkS-hQFvfrrD84qGflIEqnX' + 'ZbYnitD1Typ6Q'), + 'not-before-policy': 0, + 'refresh_expires_in': 1800, + 'refresh_token': ('eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJmNjM' + 'zMDE5MS01YTU4LTQxMDAtOGIzYS00ZDdlM2U1NjA3MTgifQ.eyJqdGk' + 'iOiIxYWI5ZWZmMS0xZWZlLTQ3MDMtOGQ2YS03Nzg1NWUwYzQyYTYiLC' + 'JleHAiOjE1ODI3MjQ5MDEsIm5iZiI6MCwiaWF0IjoxNTgyNzIzMTAxL' + 'CJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvYXV0aC9yZWFsbXMv' + 'U29mdHdhcmVIZXJpdGFnZSIsImF1ZCI6Imh0dHA6Ly9sb2NhbGhvc3Q' + '6ODA4MC9hdXRoL3JlYWxtcy9Tb2Z0d2FyZUhlcml0YWdlIiwic3ViIj' + 'oiZmVhY2QzNDQtYjQ2OC00YTY1LWEyMzYtMTRmNjFlNmI3MjAwIiwid' + 'HlwIjoiUmVmcmVzaCIsImF6cCI6InN3aC13ZWIiLCJhdXRoX3RpbWUi' + 'OjAsInNlc3Npb25fc3RhdGUiOiJkODJiOTBkMS0wYTk0LTRlNzQtYWQ' + '2Ni1kZDk1MzQxYzdiNmQiLCJyZWFsbV9hY2Nlc3MiOnsicm9sZXMiOl' + 'sib2ZmbGluZV9hY2Nlc3MiLCJ1bWFfYXV0aG9yaXphdGlvbiJdfSwic' + 'mVzb3VyY2VfYWNjZXNzIjp7ImFjY291bnQiOnsicm9sZXMiOlsibWFu' + 'YWdlLWFjY291bnQiLCJtYW5hZ2UtYWNjb3VudC1saW5rcyIsInZpZXc' + 'tcHJvZmlsZSJdfX0sInNjb3BlIjoib3BlbmlkIGVtYWlsIHByb2ZpbG' + 'UifQ.xQYrl2CMP_GQ_TFqhsTz-rTs3WuZz5I37toi1eSsDMI'), + 'scope': 'openid email profile', + 'session_state': 'd82b90d1-0a94-4e74-ad66-dd95341c7b6d', + 'token_type': 'bearer' +} + +userinfo = { + 'email': 'john.doe@example.com', + 'email_verified': False, + 'family_name': 'Doe', + 'given_name': 'John', + 'groups': ['/staff'], + 'name': 'John Doe', + 'preferred_username': 'johndoe', + 'sub': 'feacd344-b468-4a65-a236-14f61e6b7200' +} diff --git a/swh/web/tests/auth/test_backends.py b/swh/web/tests/auth/test_backends.py new file mode 100644 index 00000000..88bc7c11 --- /dev/null +++ b/swh/web/tests/auth/test_backends.py @@ -0,0 +1,81 @@ +# Copyright (C) 2020 The Software Heritage developers +# See the AUTHORS file at the top-level directory of this distribution +# License: GNU Affero General Public License version 3, or any later version +# See top-level LICENSE file for more information + +from datetime import datetime, timedelta + +from django.contrib.auth import authenticate, get_backends + +import pytest + +from django.conf import settings + +from swh.web.auth.models import OIDCUser +from swh.web.common.utils import reverse + +from . import sample_data +from .keycloak_mock import mock_keycloak + + +def _authenticate_user(request_factory): + request = request_factory.get(reverse('oidc-login-complete')) + + return authenticate(request=request, + code='some-code', + code_verifier='some-code-verifier', + redirect_uri='https://localhost:5004') + + +def _check_authenticated_user(user): + userinfo = sample_data.userinfo + assert user is not None + assert isinstance(user, OIDCUser) + assert user.id != 0 + assert user.username == userinfo['preferred_username'] + assert user.password == '' + assert user.first_name == userinfo['given_name'] + assert user.last_name == userinfo['family_name'] + assert user.email == userinfo['email'] + assert user.is_staff == ('/staff' in userinfo['groups']) + assert user.sub == userinfo['sub'] + + +@pytest.mark.django_db +def test_oidc_code_pkce_auth_backend_success(mocker, request_factory): + kc_oidc_mock = mock_keycloak(mocker) + oidc_profile = sample_data.oidc_profile + user = _authenticate_user(request_factory) + + _check_authenticated_user(user) + + decoded_token = kc_oidc_mock.decode_token( + sample_data.oidc_profile['access_token']) + auth_datetime = datetime.fromtimestamp(decoded_token['auth_time']) + + access_expiration = ( + auth_datetime + timedelta(seconds=oidc_profile['expires_in'])) + refresh_expiration = ( + auth_datetime + timedelta(seconds=oidc_profile['refresh_expires_in'])) + + assert user.access_token == oidc_profile['access_token'] + assert user.access_expiration == access_expiration + assert user.id_token == oidc_profile['id_token'] + assert user.refresh_token == oidc_profile['refresh_token'] + assert user.refresh_expiration == refresh_expiration + assert user.scope == oidc_profile['scope'] + assert user.session_state == oidc_profile['session_state'] + + backend_path = 'swh.web.auth.backends.OIDCAuthorizationCodePKCEBackend' + assert user.backend == backend_path + backend_idx = settings.AUTHENTICATION_BACKENDS.index(backend_path) + assert get_backends()[backend_idx].get_user(user.id) == user + + +@pytest.mark.django_db +def test_oidc_code_pkce_auth_backend_failure(mocker, request_factory): + mock_keycloak(mocker, auth_success=False) + + user = _authenticate_user(request_factory) + + assert user is None diff --git a/swh/web/tests/auth/test_utils.py b/swh/web/tests/auth/test_utils.py new file mode 100644 index 00000000..d564b199 --- /dev/null +++ b/swh/web/tests/auth/test_utils.py @@ -0,0 +1,37 @@ +# Copyright (C) 2020 The Software Heritage developers +# See the AUTHORS file at the top-level directory of this distribution +# License: GNU Affero General Public License version 3, or any later version +# See top-level LICENSE file for more information + +import hashlib +import re + +from base64 import urlsafe_b64encode + +from swh.web.auth.utils import gen_oidc_pkce_codes + + +def test_gen_oidc_pkce_codes(): + """ + Check generated PKCE codes respect the specification + (see https://tools.ietf.org/html/rfc7636#section-4.1) + """ + code_verifier, code_challenge = gen_oidc_pkce_codes() + + # check the code verifier only contains allowed characters + assert re.match(r'[a-zA-Z0-9-\._~]+', code_verifier) + + # check minimum and maximum authorized length for the + # code verifier + assert len(code_verifier) >= 43 + assert len(code_verifier) <= 128 + + # compute code challenge from code verifier + challenge = hashlib.sha256(code_verifier.encode('ascii')).digest() + challenge = urlsafe_b64encode(challenge).decode('ascii') + challenge = challenge.replace('=', '') + + # check base64 padding is not present + assert not code_challenge[-1].endswith('=') + # check code challenge is valid + assert code_challenge == challenge diff --git a/swh/web/tests/auth/test_views.py b/swh/web/tests/auth/test_views.py new file mode 100644 index 00000000..8b32650b --- /dev/null +++ b/swh/web/tests/auth/test_views.py @@ -0,0 +1,275 @@ +# Copyright (C) 2020 The Software Heritage developers +# See the AUTHORS file at the top-level directory of this distribution +# License: GNU Affero General Public License version 3, or any later version +# See top-level LICENSE file for more information + +from urllib.parse import urljoin, urlparse +import uuid + +from django.conf import settings +from django.http import QueryDict +from django.contrib.auth.models import AnonymousUser, User + +import pytest + +from swh.web.auth.models import OIDCUser +from swh.web.common.utils import reverse +from swh.web.tests.django_asserts import assert_template_used, assert_contains + +from . import sample_data +from .keycloak_mock import mock_keycloak + + +@pytest.mark.django_db +def test_oidc_login_views_success(client, mocker): + """ + Simulate a successful login authentication with OpenID Connect + authorization code flow with PKCE. + """ + # mock Keycloak client + kc_oidc_mock = mock_keycloak(mocker) + + # user initiates login process + login_url = reverse('oidc-login') + response = client.get(login_url) + request = response.wsgi_request + + # should redirect to Keycloak authentication page in order + # for a user to login with its username / password + assert response.status_code == 302 + assert isinstance(request.user, AnonymousUser) + + parsed_url = urlparse(response['location']) + + authorization_url = kc_oidc_mock.well_known()['authorization_endpoint'] + query_dict = QueryDict(parsed_url.query) + + # check redirect url is valid + assert urljoin(response['location'], parsed_url.path) == authorization_url + assert 'client_id' in query_dict + assert query_dict['client_id'] == settings.OIDC_SWH_WEB_CLIENT_ID + assert 'response_type' in query_dict + assert query_dict['response_type'] == 'code' + assert 'redirect_uri' in query_dict + assert query_dict['redirect_uri'] == reverse('oidc-login-complete', + request=request) + assert 'code_challenge_method' in query_dict + assert query_dict['code_challenge_method'] == 'S256' + assert 'scope' in query_dict + assert query_dict['scope'] == 'openid' + assert 'state' in query_dict + assert 'code_challenge' in query_dict + + # check a login_data has been registered in user session + assert 'login_data' in request.session + login_data = request.session['login_data'] + assert 'code_verifier' in login_data + assert 'state' in login_data + assert 'redirect_uri' in login_data + assert login_data['redirect_uri'] == query_dict['redirect_uri'] + + # once a user has identified himself in Keycloak, he is + # redirected to the 'oidc-login-complete' view to + # login in Django. + + # generate authorization code / session state in the same + # manner as Keycloak + code = f'{str(uuid.uuid4())}.{str(uuid.uuid4())}.{str(uuid.uuid4())}' + session_state = str(uuid.uuid4()) + + login_complete_url = reverse('oidc-login-complete', + query_params={'code': code, + 'state': login_data['state'], + 'session_state': session_state}) + + # login process finalization + response = client.get(login_complete_url) + request = response.wsgi_request + + # should redirect to root url by default + assert response.status_code == 302 + assert response['location'] == request.build_absolute_uri('/') + + # user should be authenticated + assert isinstance(request.user, OIDCUser) + + # check remote user has not been saved to Django database + with pytest.raises(User.DoesNotExist): + User.objects.get(username=request.user.username) + + +@pytest.mark.django_db +def test_oidc_logout_view_success(client, mocker): + """ + Simulate a successful logout operation with OpenID Connect. + """ + # mock Keycloak client + kc_oidc_mock = mock_keycloak(mocker) + # login our test user + client.login(code='', code_verifier='', redirect_uri='') + kc_oidc_mock.authorization_code.assert_called() + + # user initiates logout + oidc_logout_url = reverse('oidc-logout') + response = client.get(oidc_logout_url) + request = response.wsgi_request + + # should redirect to logout page + assert response.status_code == 302 + logout_url = reverse('logout', query_params={'remote_user': 1}) + assert response['location'] == request.build_absolute_uri(logout_url) + + # should have been logged out in Keycloak + kc_oidc_mock.logout.assert_called_with( + sample_data.oidc_profile['refresh_token']) + + # check effective logout in Django + assert isinstance(request.user, AnonymousUser) + + +@pytest.mark.django_db +def test_oidc_login_view_failure(client, mocker): + """ + Simulate a failed authentication with OpenID Connect. + """ + # mock Keycloak client + mock_keycloak(mocker, auth_success=False) + + # user initiates login process + login_url = reverse('oidc-login') + response = client.get(login_url) + request = response.wsgi_request + + # should render an error page + assert response.status_code == 500 + assert_template_used(response, "error.html") + + # no users should be logged in + assert isinstance(request.user, AnonymousUser) + + +# Simulate possible errors with OpenID Connect in the login complete view. + +def test_oidc_login_complete_view_no_login_data(client, mocker): + # user initiates login process + login_url = reverse('oidc-login-complete') + response = client.get(login_url) + + # should render an error page + assert_template_used(response, "error.html") + assert_contains(response, 'Login process has not been initialized.', + status_code=500) + + +def test_oidc_login_complete_view_missing_parameters(client, mocker): + # simulate login process has been initialized + session = client.session + session['login_data'] = { + 'code_verifier': '', + 'state': str(uuid.uuid4()), + 'redirect_uri': '', + 'next': None, + } + session.save() + + # user initiates login process + login_url = reverse('oidc-login-complete') + response = client.get(login_url) + request = response.wsgi_request + + # should render an error page + assert_template_used(response, "error.html") + assert_contains(response, 'Missing query parameters for authentication.', + status_code=400) + + # no user should be logged in + assert isinstance(request.user, AnonymousUser) + + +def test_oidc_login_complete_wrong_csrf_token(client, mocker): + # mock Keycloak client + mock_keycloak(mocker) + + # simulate login process has been initialized + session = client.session + session['login_data'] = { + 'code_verifier': '', + 'state': str(uuid.uuid4()), + 'redirect_uri': '', + 'next': None, + } + session.save() + + # user initiates login process + login_url = reverse('oidc-login-complete', + query_params={'code': 'some-code', + 'state': 'some-state'}) + + response = client.get(login_url) + request = response.wsgi_request + + # should render an error page + assert_template_used(response, "error.html") + assert_contains(response, 'Wrong CSRF token, aborting login process.', + status_code=400) + + # no user should be logged in + assert isinstance(request.user, AnonymousUser) + + +@pytest.mark.django_db +def test_oidc_login_complete_wrong_code_verifier(client, mocker): + # mock Keycloak client + mock_keycloak(mocker, auth_success=False) + + # simulate login process has been initialized + session = client.session + session['login_data'] = { + 'code_verifier': '', + 'state': str(uuid.uuid4()), + 'redirect_uri': '', + 'next': None, + } + session.save() + + # check authentication error is reported + login_url = reverse('oidc-login-complete', + query_params={'code': 'some-code', + 'state': session['login_data']['state']}) + + response = client.get(login_url) + request = response.wsgi_request + + # should render an error page + assert_template_used(response, "error.html") + assert_contains(response, 'User authentication failed.', + status_code=500) + + # no user should be logged in + assert isinstance(request.user, AnonymousUser) + + +@pytest.mark.django_db +def test_oidc_logout_view_failure(client, mocker): + """ + Simulate a failed logout operation with OpenID Connect. + """ + # mock Keycloak client + kc_oidc_mock = mock_keycloak(mocker) + # login our test user + client.login(code='', code_verifier='', redirect_uri='') + + err_msg = 'Authentication server error' + kc_oidc_mock.logout.side_effect = Exception(err_msg) + + # user initiates logout process + logout_url = reverse('oidc-logout') + response = client.get(logout_url) + request = response.wsgi_request + + # should render an error page + assert_template_used(response, "error.html") + assert_contains(response, err_msg, status_code=500) + + # user should be logged out from Django anyway + assert isinstance(request.user, AnonymousUser) diff --git a/swh/web/urls.py b/swh/web/urls.py index f6ecfb7f..c4e5be4e 100644 --- a/swh/web/urls.py +++ b/swh/web/urls.py @@ -1,61 +1,67 @@ -# Copyright (C) 2017-2019 The Software Heritage developers +# Copyright (C) 2017-2020 The Software Heritage developers # See the AUTHORS file at the top-level directory of this distribution # License: GNU Affero General Public License version 3, or any later version # See top-level LICENSE file for more information from django.conf import settings from django.conf.urls import ( url, include, handler400, handler403, handler404, handler500 ) +from django.contrib.auth.views import LogoutView from django.contrib.staticfiles.views import serve + from django.shortcuts import render from django.views.generic.base import RedirectView from django_js_reverse.views import urls_js from swh.web.browse.identifiers import swh_id_browse from swh.web.config import get_config from swh.web.common.exc import ( swh_handle400, swh_handle403, swh_handle404, swh_handle500 ) swh_web_config = get_config() favicon_view = RedirectView.as_view(url='/static/img/icons/swh-logo-32x32.png', permanent=True) def _default_view(request): return render(request, "homepage.html") urlpatterns = [ url(r'^admin/', include('swh.web.admin.urls')), url(r'^favicon\.ico$', favicon_view), url(r'^api/', include('swh.web.api.urls')), url(r'^browse/', include('swh.web.browse.urls')), url(r'^$', _default_view, name='swh-web-homepage'), url(r'^jsreverse/$', urls_js, name='js_reverse'), url(r'^(?P