mirror of
https://github.com/fleetdm/fleet
synced 2026-05-15 21:18:29 +00:00
c69d56ed64
For https://github.com/fleetdm/confidential/issues/9931.
[Here](ec3e8edbdc/docs/Contributing/Testing-and-local-development.md (L339))'s
how to test SAML locally with SimpleSAML.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Added/updated automated tests
- [x] A detailed QA plan exists on the associated ticket (if it isn't
there, work with the product group's QA engineer to add it)
- [x] Manual QA for all new/changed functionality
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Improved SSO and SAML integration with enhanced session management
using secure cookies.
* Added support for IdP-initiated login flows.
* Introduced new tests covering SSO login flows, metadata handling, and
error scenarios.
* **Bug Fixes**
* Enhanced validation and error handling for invalid or tampered SAML
responses.
* Fixed session cookie handling during SSO and Apple MDM SSO flows.
* **Refactor**
* Replaced custom SAML implementation with the crewjam/saml library for
improved reliability.
* Simplified SAML metadata parsing and session store management.
* Streamlined SSO authorization request and response processing.
* Removed deprecated fields and redundant code related to SSO.
* **Documentation**
* Updated testing and local development docs with clearer instructions
for SSO and IdP-initiated login.
* **Chores**
* Upgraded dependencies including crewjam/saml and related packages.
* Cleaned up tests and configuration by removing deprecated fields and
unused imports.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
62 lines
1.8 KiB
Go
62 lines
1.8 KiB
Go
package sso
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/fleetdm/fleet/v4/server/datastore/redis/redistest"
|
|
"github.com/fleetdm/fleet/v4/server/fleet"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestSessionStore(t *testing.T) {
|
|
runTest := func(t *testing.T, pool fleet.RedisPool) {
|
|
store := NewSessionStore(pool)
|
|
|
|
// Create session that lives for 1 second.
|
|
err := store.create("sessionID123", "requestID123", "https://originalurl.com", "some metadata", 1)
|
|
require.NoError(t, err)
|
|
|
|
sess, err := store.get("sessionID123")
|
|
require.NoError(t, err)
|
|
require.NotNil(t, sess)
|
|
assert.Equal(t, "requestID123", sess.RequestID)
|
|
assert.Equal(t, "https://originalurl.com", sess.OriginalURL)
|
|
assert.Equal(t, "some metadata", sess.Metadata)
|
|
|
|
// Wait a little bit more than one second, session should no longer be present.
|
|
time.Sleep(1100 * time.Millisecond)
|
|
sess, err = store.get("sessionID123")
|
|
var authRequiredError *fleet.AuthRequiredError
|
|
assert.ErrorAs(t, err, &authRequiredError)
|
|
assert.Nil(t, sess)
|
|
|
|
// Create another session for 1 second
|
|
err = store.create("sessionID456", "requestID456", "https://originalurl.com", "some metadata", 1)
|
|
require.NoError(t, err)
|
|
|
|
// Forcefully expire it
|
|
err = store.expire("sessionID456")
|
|
require.NoError(t, err)
|
|
|
|
// It is not present anymore
|
|
sess, err = store.get("sessionID456")
|
|
assert.ErrorAs(t, err, &authRequiredError)
|
|
assert.Nil(t, sess)
|
|
|
|
// Expire a session that does not exist is fine
|
|
err = store.expire("sessionIDNOSUCH")
|
|
require.NoError(t, err)
|
|
}
|
|
|
|
t.Run("standalone", func(t *testing.T) {
|
|
p := redistest.SetupRedis(t, "request", false, false, false)
|
|
runTest(t, p)
|
|
})
|
|
|
|
t.Run("cluster", func(t *testing.T) {
|
|
p := redistest.SetupRedis(t, "request", true, false, false)
|
|
runTest(t, p)
|
|
})
|
|
}
|