mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-16 19:59:07 +02:00
Zoltán Papp
907e66b9d7
login_hint is a suggestion the IdP may ignore: with a silent flow configured (DisablePromptLogin or max_age=0) and a live IdP session for another account, the login completes with that account's token. On a registered peer the management server rejects it as a user mismatch, but on a fresh profile the peer silently registers under the wrong account and the profile is then bound to it — every later login follows the stored hint straight back. After the token exchange, compare the ID token's email against the hint the flow was sent with. On a mismatch, do not log in to management with the token; run one more round asking the IdP to re-decide the account (prompt=login, via ForceAccountPrompt — DisablePromptLogin still wins there). If the prompted round also comes back different, proceed with a warning: the address may legitimately have changed, and refusing forever would lock the user out of the profile while the management server still rejects a token that does not own the peer. A token or profile with no email to compare is not judged. The retry differs per platform because of who opens the browser: - CLI (netbird login foreground) and Android run the whole flow in one process, so the mismatch retries automatically: the browser reopens with the account prompt within the same login attempt. - On desktop the login is split between the daemon and the GUI: Login hands the authorize URL to the GUI, WaitSSOLogin blocks for the token, and only the GUI can open a browser. A new URL cannot be handed out from inside WaitSSOLogin (its response has no field for one, kept that way to avoid a proto change), so the daemon arms forceAccountPrompt, fails the round with "connect again to choose the account", and builds the next Login's flow with the prompt — the user's next connect is the retry. The flag and the flow annotations live in daemon memory only; SwitchProfile drops them so the previous profile's hint cannot judge the next profile's token. The device code flow has no prompt parameter (RFC 8628), so a prompted round there runs as-is and a repeated mismatch is let through with the warning rather than looping.
105 lines
2.3 KiB
Go
105 lines
2.3 KiB
Go
package auth
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"encoding/json"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestTokenInfoMatchesAccount(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
token TokenInfo
|
|
hint string
|
|
match bool
|
|
}{
|
|
{
|
|
name: "same account",
|
|
token: TokenInfo{Email: "user@example.com"},
|
|
hint: "user@example.com",
|
|
match: true,
|
|
},
|
|
{
|
|
name: "different account",
|
|
token: TokenInfo{Email: "other@example.com"},
|
|
hint: "user@example.com",
|
|
match: false,
|
|
},
|
|
{
|
|
name: "case differences are the same account",
|
|
token: TokenInfo{Email: "User@Example.com"},
|
|
hint: "user@example.com",
|
|
match: true,
|
|
},
|
|
{
|
|
name: "no hint leaves the choice to the IdP",
|
|
token: TokenInfo{Email: "other@example.com"},
|
|
hint: "",
|
|
match: true,
|
|
},
|
|
{
|
|
name: "token without an email is not judged",
|
|
token: TokenInfo{Email: ""},
|
|
hint: "user@example.com",
|
|
match: true,
|
|
},
|
|
}
|
|
|
|
for _, tc := range tests {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
assert.Equal(t, tc.match, tc.token.MatchesAccount(tc.hint))
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestParseEmailFromIDToken(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
claims map[string]interface{}
|
|
wantValue string
|
|
wantErr bool
|
|
}{
|
|
{
|
|
name: "email claim",
|
|
claims: map[string]interface{}{"email": "user@example.com", "name": "Some One"},
|
|
wantValue: "user@example.com",
|
|
},
|
|
{
|
|
name: "name fallback",
|
|
claims: map[string]interface{}{"name": "Some One"},
|
|
wantValue: "Some One",
|
|
},
|
|
{
|
|
name: "neither claim present",
|
|
claims: map[string]interface{}{"sub": "abc"},
|
|
wantErr: true,
|
|
},
|
|
}
|
|
|
|
for _, tc := range tests {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
value, err := parseEmailFromIDToken(idTokenWithClaims(t, tc.claims))
|
|
if tc.wantErr {
|
|
require.Error(t, err)
|
|
return
|
|
}
|
|
require.NoError(t, err)
|
|
assert.Equal(t, tc.wantValue, value)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestRetryFlowForAccountUnsupportedFlow(t *testing.T) {
|
|
assert.Nil(t, RetryFlowForAccount(&DeviceAuthorizationFlow{}))
|
|
}
|
|
|
|
func idTokenWithClaims(t *testing.T, claims map[string]interface{}) string {
|
|
t.Helper()
|
|
payload, err := json.Marshal(claims)
|
|
require.NoError(t, err)
|
|
return "header." + base64.RawURLEncoding.EncodeToString(payload) + ".signature"
|
|
}
|