sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-26 14:29:08 +01:00
Code Issues Packages Projects Releases Wiki Activity

[client] Force interactive login when extending the auth session

Browse Source 
A session extend must be answered from the account the peer is registered
under. With a silent PKCE flow (DisablePromptLogin or max_age=0) the IdP
answers from whatever session it already holds, which need not be the
peer's account when several are signed in; the token then fails the
user match in ExtendAuthSession with no way to pick another account.

Mark the PKCE flow request as a session extend so the management server
can force prompt=login for it, overriding the configured silent flow.
This commit is contained in:
Zoltán Papp
2026-08-15 10:33:50 +02:00
parent 2cfe14d7ec
commit 0738734b6e
16 changed files with 854 additions and 694 deletions
Download Patch File Download Diff File Expand all files Collapse all files
shared/management/client/client_test.go
+8 -1
View File
@@ -595,7 +595,12 @@ func Test_GetPKCEAuthorizationFlow(t *testing.T) {
},
}
var gotRequest mgmtProto.PKCEAuthorizationFlowRequest
mgmtMockServer.GetPKCEAuthorizationFlowFunc = func(ctx context.Context, req *mgmtProto.EncryptedMessage) (*mgmtProto.EncryptedMessage, error) {
if err := encryption.DecryptMessage(client.key.PublicKey(), serverKey, req.Body, &gotRequest); err != nil {
return nil, err
}
encryptedResp, err := encryption.EncryptMessage(client.key.PublicKey(), serverKey, expectedFlowInfo)
if err != nil {
return nil, err
@@ -608,11 +613,13 @@ func Test_GetPKCEAuthorizationFlow(t *testing.T) {
}, nil
}
flowInfo, err := client.GetPKCEAuthorizationFlow()
flowInfo, err := client.GetPKCEAuthorizationFlow(true)
if err != nil {
t.Error("error while retrieving pkce auth flow information")
}
assert.True(t, gotRequest.GetSessionExtend(), "session extend should reach the server")
assert.Equal(t, expectedFlowInfo.ProviderConfig.ClientID, flowInfo.ProviderConfig.ClientID, "provider configured client ID should match")
assert.Equal(t, expectedFlowInfo.ProviderConfig.ClientSecret, flowInfo.ProviderConfig.ClientSecret, "provider configured client secret should match") //nolint:staticcheck
}