sevenhill/QSfera
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #5955 from owncloud/ainmosni/feature/keycloak-pkg

Browse Source 
Add keycloak package.
This commit is contained in:
kobergj
2023-03-30 15:01:49 +02:00
committed by GitHub
parent 71775b3c65 a0686c4f47
commit e46041b01f
8 changed files with 456 additions and 279 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/invitations/pkg/backends/keycloak/backend.go
+37 -79
View File
@@ -3,31 +3,28 @@ package keycloak
import (
"context"
"crypto/tls"
"fmt"
"github.com/Nerzal/gocloak/v13"
"github.com/google/uuid"
libregraph "github.com/owncloud/libre-graph-api-go"
"github.com/owncloud/ocis/v2/ocis-pkg/keycloak"
"github.com/owncloud/ocis/v2/ocis-pkg/log"
"github.com/owncloud/ocis/v2/services/invitations/pkg/invitations"
)
const (
idAttr = "OWNCLOUD_ID"
userTypeAttr = "OWNCLOUD_USER_TYPE"
userTypeVal = "Guest"
userType = "Guest"
)
var userRequiredActions = []string{"UPDATE_PASSWORD", "VERIFY_EMAIL"}
var userRequiredActions = []keycloak.UserAction{
keycloak.UserActionUpdatePassword,
keycloak.UserActionVerifyEmail,
}
// Backend represents the keycloak backend.
type Backend struct {
logger log.Logger
client GoCloak
clientID string
clientSecret string
clientRealm string
userRealm string
logger log.Logger
client keycloak.Client
userRealm string
}
// New instantiates a new keycloak.Backend with a default gocloak client.
@@ -36,62 +33,50 @@ func New(
baseURL, clientID, clientSecret, clientRealm, userRealm string,
insecureSkipVerify bool,
) *Backend {
client := gocloak.NewClient(baseURL)
restyClient := client.RestyClient()
restyClient.SetTLSClientConfig(&tls.Config{InsecureSkipVerify: insecureSkipVerify}) //nolint:gosec
return NewWithClient(logger, client, clientID, clientSecret, clientRealm, userRealm)
logger = log.Logger{
Logger: logger.With().
Str("invitationBackend", "keycloak").
Str("clientID", clientID).
Str("clientRealm", clientRealm).
Str("userRealm", userRealm).
Logger(),
}
client := keycloak.New(baseURL, clientID, clientSecret, clientRealm, insecureSkipVerify)
return NewWithClient(logger, client, userRealm)
}
// NewWithClient creates a new backend with the supplied GoCloak client.
// NewWithClient creates a new backend with the supplied keycloak client.
func NewWithClient(
logger log.Logger,
client GoCloak,
clientID, clientSecret, clientRealm, userRealm string,
client keycloak.Client,
userRealm string,
) *Backend {
return &Backend{
logger: log.Logger{
Logger: logger.With().
Str("invitationBackend", "keycloak").
Str("clientID", clientID).
Str("clientRealm", clientRealm).
Str("userRealm", userRealm).
Logger(),
},
client: client,
clientID: clientID,
clientSecret: clientSecret,
clientRealm: clientRealm,
userRealm: userRealm,
logger: logger,
client: client,
userRealm: userRealm,
}
}
// CreateUser creates a user in the keycloak backend.
func (b Backend) CreateUser(ctx context.Context, invitation *invitations.Invitation) (string, error) {
token, err := b.getToken(ctx)
if err != nil {
return "", err
}
u := uuid.New()
b.logger.Info().
Str(idAttr, u.String()).
Str("email", invitation.InvitedUserEmailAddress).
Msg("Creating new user")
user := gocloak.User{
Email: &invitation.InvitedUserEmailAddress,
Enabled: gocloak.BoolP(true),
Username: &invitation.InvitedUserEmailAddress,
Attributes: &map[string][]string{
idAttr: {u.String()},
userTypeAttr: {userTypeVal},
},
RequiredActions: &userRequiredActions,
user := &libregraph.User{
Mail: &invitation.InvitedUserEmailAddress,
AccountEnabled: boolP(true),
OnPremisesSamAccountName: &invitation.InvitedUserEmailAddress,
Id: stringP(u.String()),
UserType: stringP(userType),
}
id, err := b.client.CreateUser(ctx, token.AccessToken, b.userRealm, user)
id, err := b.client.CreateUser(ctx, b.userRealm, user, userRequiredActions)
if err != nil {
b.logger.Error().
Str(idAttr, u.String()).
Str("userID", u.String()).
Str("email", invitation.InvitedUserEmailAddress).
Err(err).
Msg("Failed to create user")
@@ -106,35 +91,8 @@ func (b Backend) CanSendMail() bool { return true }
// SendMail sends a mail to the user with details on how to reedeem the invitation.
func (b Backend) SendMail(ctx context.Context, id string) error {
token, err := b.getToken(ctx)
if err != nil {
return err
}
params := gocloak.ExecuteActionsEmail{
UserID: &id,
Actions: &userRequiredActions,
}
return b.client.ExecuteActionsEmail(ctx, token.AccessToken, b.userRealm, params)
return b.client.SendActionsMail(ctx, b.userRealm, id, userRequiredActions)
}
func (b Backend) getToken(ctx context.Context) (*gocloak.JWT, error) {
b.logger.Debug().Msg("Logging into keycloak")
token, err := b.client.LoginClient(ctx, b.clientID, b.clientSecret, b.clientRealm)
if err != nil {
b.logger.Error().Err(err).Msg("failed to get token")
return nil, fmt.Errorf("failed to get token: %w", err)
}
rRes, err := b.client.RetrospectToken(ctx, token.AccessToken, b.clientID, b.clientSecret, b.clientRealm)
if err != nil {
b.logger.Error().Err(err).Msg("failed to introspect token")
return nil, fmt.Errorf("failed to retrospect token: %w", err)
}
if !*rRes.Active {
b.logger.Error().Msg("token not active")
return nil, fmt.Errorf("token is not active")
}
return token, nil
}
func boolP(b bool) *bool { return &b }
func stringP(s string) *string { return &s }
services/invitations/pkg/backends/keycloak/backend_test.go
+27 -87
View File
@@ -7,7 +7,7 @@ import (
"context"
"testing"
"github.com/Nerzal/gocloak/v13"
kcpkg "github.com/owncloud/ocis/v2/ocis-pkg/keycloak"
"github.com/owncloud/ocis/v2/ocis-pkg/log"
"github.com/owncloud/ocis/v2/services/invitations/pkg/backends/keycloak"
"github.com/owncloud/ocis/v2/services/invitations/pkg/invitations"
@@ -34,11 +34,11 @@ func TestBackend_CreateUser(t *testing.T) {
returns []interface{}
}
tests := []struct {
name string
args args
want string
keycloakMocks []mockInputs
assertion assert.ErrorAssertionFunc
name string
args args
want string
clientMocks []mockInputs
assertion assert.ErrorAssertionFunc
}{
{
name: "Test without diplay name",
@@ -48,46 +48,17 @@ func TestBackend_CreateUser(t *testing.T) {
},
},
want: "test-id",
keycloakMocks: []mockInputs{
{
funcName: "LoginClient",
args: []interface{}{
mock.Anything,
clientID,
clientSecret,
clientRealm,
},
returns: []interface{}{
&gocloak.JWT{
AccessToken: jwtToken,
},
nil,
},
},
{
funcName: "RetrospectToken",
args: []interface{}{
mock.Anything,
jwtToken,
clientID,
clientSecret,
clientRealm,
},
returns: []interface{}{
&gocloak.IntroSpectTokenResult{
Active: gocloak.BoolP(true),
},
nil,
},
},
clientMocks: []mockInputs{
{
funcName: "CreateUser",
args: []interface{}{
mock.Anything,
jwtToken,
userRealm,
mock.Anything, // can't match on the user because it generates a UUID internally.
// might be worth refactoring the UUID generation to outside of the func
[]kcpkg.UserAction{
kcpkg.UserActionUpdatePassword,
kcpkg.UserActionVerifyEmail,
},
},
returns: []interface{}{
"test-id",
@@ -103,11 +74,11 @@ func TestBackend_CreateUser(t *testing.T) {
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
ctx := context.Background()
c := &mocks.GoCloak{}
for _, m := range tt.keycloakMocks {
c := &mocks.Client{}
for _, m := range tt.clientMocks {
c.On(m.funcName, m.args...).Return(m.returns...)
}
b := keycloak.NewWithClient(log.NopLogger(), c, clientID, clientSecret, clientRealm, userRealm)
b := keycloak.NewWithClient(log.NopLogger(), c, userRealm)
got, err := b.CreateUser(ctx, tt.args.invitation)
tt.assertion(t, err)
assert.Equal(t, tt.want, got)
@@ -125,57 +96,26 @@ func TestBackend_SendMail(t *testing.T) {
returns []interface{}
}
tests := []struct {
name string
args args
keycloakMocks []mockInputs
assertion assert.ErrorAssertionFunc
name string
args args
clientMocks []mockInputs
assertion assert.ErrorAssertionFunc
}{
{
name: "Mail successfully sent",
args: args{
id: "test-id",
},
keycloakMocks: []mockInputs{
clientMocks: []mockInputs{
{
funcName: "LoginClient",
funcName: "SendActionsMail",
args: []interface{}{
mock.Anything,
clientID,
clientSecret,
clientRealm,
},
returns: []interface{}{
&gocloak.JWT{
AccessToken: jwtToken,
},
nil,
},
},
{
funcName: "RetrospectToken",
args: []interface{}{
mock.Anything,
jwtToken,
clientID,
clientSecret,
clientRealm,
},
returns: []interface{}{
&gocloak.IntroSpectTokenResult{
Active: gocloak.BoolP(true),
},
nil,
},
},
{
funcName: "ExecuteActionsEmail",
args: []interface{}{
mock.Anything,
jwtToken,
userRealm,
gocloak.ExecuteActionsEmail{
UserID: gocloak.StringP("test-id"),
Actions: &[]string{"UPDATE_PASSWORD", "VERIFY_EMAIL"},
"test-id",
[]kcpkg.UserAction{
kcpkg.UserActionUpdatePassword,
kcpkg.UserActionVerifyEmail,
},
},
returns: []interface{}{
@@ -191,11 +131,11 @@ func TestBackend_SendMail(t *testing.T) {
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
ctx := context.Background()
c := &mocks.GoCloak{}
for _, m := range tt.keycloakMocks {
c := &mocks.Client{}
for _, m := range tt.clientMocks {
c.On(m.funcName, m.args...).Return(m.returns...)
}
b := keycloak.NewWithClient(log.NopLogger(), c, clientID, clientSecret, clientRealm, userRealm)
b := keycloak.NewWithClient(log.NopLogger(), c, userRealm)
tt.assertion(t, b.SendMail(ctx, tt.args.id))
})
}
services/invitations/pkg/mocks/client.go
+122
View File
@@ -0,0 +1,122 @@
// Code generated by mockery v2.22.1. DO NOT EDIT.
package mocks
import (
context "context"
libregraph "github.com/owncloud/libre-graph-api-go"
keycloak "github.com/owncloud/ocis/v2/ocis-pkg/keycloak"
mock "github.com/stretchr/testify/mock"
)
// Client is an autogenerated mock type for the Client type
type Client struct {
mock.Mock
}
// CreateUser provides a mock function with given fields: ctx, realm, user, userActions
func (_m *Client) CreateUser(ctx context.Context, realm string, user *libregraph.User, userActions []keycloak.UserAction) (string, error) {
ret := _m.Called(ctx, realm, user, userActions)
var r0 string
var r1 error
if rf, ok := ret.Get(0).(func(context.Context, string, *libregraph.User, []keycloak.UserAction) (string, error)); ok {
return rf(ctx, realm, user, userActions)
}
if rf, ok := ret.Get(0).(func(context.Context, string, *libregraph.User, []keycloak.UserAction) string); ok {
r0 = rf(ctx, realm, user, userActions)
} else {
r0 = ret.Get(0).(string)
}
if rf, ok := ret.Get(1).(func(context.Context, string, *libregraph.User, []keycloak.UserAction) error); ok {
r1 = rf(ctx, realm, user, userActions)
} else {
r1 = ret.Error(1)
}
return r0, r1
}
// GetPIIReport provides a mock function with given fields: ctx, realm, user
func (_m *Client) GetPIIReport(ctx context.Context, realm string, user *libregraph.User) (*keycloak.PIIReport, error) {
ret := _m.Called(ctx, realm, user)
var r0 *keycloak.PIIReport
var r1 error
if rf, ok := ret.Get(0).(func(context.Context, string, *libregraph.User) (*keycloak.PIIReport, error)); ok {
return rf(ctx, realm, user)
}
if rf, ok := ret.Get(0).(func(context.Context, string, *libregraph.User) *keycloak.PIIReport); ok {
r0 = rf(ctx, realm, user)
} else {
if ret.Get(0) != nil {
r0 = ret.Get(0).(*keycloak.PIIReport)
}
}
if rf, ok := ret.Get(1).(func(context.Context, string, *libregraph.User) error); ok {
r1 = rf(ctx, realm, user)
} else {
r1 = ret.Error(1)
}
return r0, r1
}
// GetUserByEmail provides a mock function with given fields: ctx, realm, email
func (_m *Client) GetUserByEmail(ctx context.Context, realm string, email string) (*libregraph.User, error) {
ret := _m.Called(ctx, realm, email)
var r0 *libregraph.User
var r1 error
if rf, ok := ret.Get(0).(func(context.Context, string, string) (*libregraph.User, error)); ok {
return rf(ctx, realm, email)
}
if rf, ok := ret.Get(0).(func(context.Context, string, string) *libregraph.User); ok {
r0 = rf(ctx, realm, email)
} else {
if ret.Get(0) != nil {
r0 = ret.Get(0).(*libregraph.User)
}
}
if rf, ok := ret.Get(1).(func(context.Context, string, string) error); ok {
r1 = rf(ctx, realm, email)
} else {
r1 = ret.Error(1)
}
return r0, r1
}
// SendActionsMail provides a mock function with given fields: ctx, realm, userID, userActions
func (_m *Client) SendActionsMail(ctx context.Context, realm string, userID string, userActions []keycloak.UserAction) error {
ret := _m.Called(ctx, realm, userID, userActions)
var r0 error
if rf, ok := ret.Get(0).(func(context.Context, string, string, []keycloak.UserAction) error); ok {
r0 = rf(ctx, realm, userID, userActions)
} else {
r0 = ret.Error(0)
}
return r0
}
type mockConstructorTestingTNewClient interface {
mock.TestingT
Cleanup(func())
}
// NewClient creates a new instance of Client. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
func NewClient(t mockConstructorTestingTNewClient) *Client {
mock := &Client{}
mock.Mock.Test(t)
t.Cleanup(func() { mock.AssertExpectations(t) })
return mock
}
services/invitations/pkg/mocks/go_cloak.go
-112
View File
@@ -1,112 +0,0 @@
// Code generated by mockery v2.14.1. DO NOT EDIT.
package mocks
import (
context "context"
gocloak "github.com/Nerzal/gocloak/v13"
mock "github.com/stretchr/testify/mock"
)
// GoCloak is an autogenerated mock type for the GoCloak type
type GoCloak struct {
mock.Mock
}
// CreateUser provides a mock function with given fields: ctx, token, realm, user
func (_m *GoCloak) CreateUser(ctx context.Context, token string, realm string, user gocloak.User) (string, error) {
ret := _m.Called(ctx, token, realm, user)
var r0 string
if rf, ok := ret.Get(0).(func(context.Context, string, string, gocloak.User) string); ok {
r0 = rf(ctx, token, realm, user)
} else {
r0 = ret.Get(0).(string)
}
var r1 error
if rf, ok := ret.Get(1).(func(context.Context, string, string, gocloak.User) error); ok {
r1 = rf(ctx, token, realm, user)
} else {
r1 = ret.Error(1)
}
return r0, r1
}
// ExecuteActionsEmail provides a mock function with given fields: ctx, token, realm, params
func (_m *GoCloak) ExecuteActionsEmail(ctx context.Context, token string, realm string, params gocloak.ExecuteActionsEmail) error {
ret := _m.Called(ctx, token, realm, params)
var r0 error
if rf, ok := ret.Get(0).(func(context.Context, string, string, gocloak.ExecuteActionsEmail) error); ok {
r0 = rf(ctx, token, realm, params)
} else {
r0 = ret.Error(0)
}
return r0
}
// LoginClient provides a mock function with given fields: ctx, clientID, clientSecret, realm
func (_m *GoCloak) LoginClient(ctx context.Context, clientID string, clientSecret string, realm string) (*gocloak.JWT, error) {
ret := _m.Called(ctx, clientID, clientSecret, realm)
var r0 *gocloak.JWT
if rf, ok := ret.Get(0).(func(context.Context, string, string, string) *gocloak.JWT); ok {
r0 = rf(ctx, clientID, clientSecret, realm)
} else {
if ret.Get(0) != nil {
r0 = ret.Get(0).(*gocloak.JWT)
}
}
var r1 error
if rf, ok := ret.Get(1).(func(context.Context, string, string, string) error); ok {
r1 = rf(ctx, clientID, clientSecret, realm)
} else {
r1 = ret.Error(1)
}
return r0, r1
}
// RetrospectToken provides a mock function with given fields: ctx, accessToken, clientID, clientSecret, realm
func (_m *GoCloak) RetrospectToken(ctx context.Context, accessToken string, clientID string, clientSecret string, realm string) (*gocloak.IntroSpectTokenResult, error) {
ret := _m.Called(ctx, accessToken, clientID, clientSecret, realm)
var r0 *gocloak.IntroSpectTokenResult
if rf, ok := ret.Get(0).(func(context.Context, string, string, string, string) *gocloak.IntroSpectTokenResult); ok {
r0 = rf(ctx, accessToken, clientID, clientSecret, realm)
} else {
if ret.Get(0) != nil {
r0 = ret.Get(0).(*gocloak.IntroSpectTokenResult)
}
}
var r1 error
if rf, ok := ret.Get(1).(func(context.Context, string, string, string, string) error); ok {
r1 = rf(ctx, accessToken, clientID, clientSecret, realm)
} else {
r1 = ret.Error(1)
}
return r0, r1
}
type mockConstructorTestingTNewGoCloak interface {
mock.TestingT
Cleanup(func())
}
// NewGoCloak creates a new instance of GoCloak. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
func NewGoCloak(t mockConstructorTestingTNewGoCloak) *GoCloak {
mock := &GoCloak{}
mock.Mock.Test(t)
t.Cleanup(func() { mock.AssertExpectations(t) })
return mock
}