mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-13 18:29:07 +02:00
Zoltán Papp
70ef1d2f25
Forcing prompt=login on a session extend overrode DisablePromptLogin, which is set for IdPs that break on it: Authentik triggers a double authentication and social logins fail outright. Overriding it there trades a recoverable extend for a login that cannot complete at all. Keep the LoginFlag override, which only replaces max_age=0 or none with prompt=login so the IdP honours login_hint, and leave DisablePromptLogin as configured. Those deployments keep the silent flow, and with several accounts signed in an extend answered from the wrong one still fails the user match.
88 lines
2.5 KiB
Go
88 lines
2.5 KiB
Go
package grpc
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
|
|
"github.com/netbirdio/netbird/shared/management/client/common"
|
|
"github.com/netbirdio/netbird/shared/management/proto"
|
|
)
|
|
|
|
func TestApplySessionExtendFlowPolicy(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
flow *proto.PKCEAuthorizationFlow
|
|
sessionExtend bool
|
|
disablePromptLogin bool
|
|
loginFlag uint32
|
|
}{
|
|
{
|
|
name: "extend replaces max_age=0 so login_hint is honoured",
|
|
flow: &proto.PKCEAuthorizationFlow{
|
|
ProviderConfig: &proto.ProviderConfig{
|
|
DisablePromptLogin: false,
|
|
LoginFlag: uint32(common.LoginFlagMaxAge0),
|
|
},
|
|
},
|
|
sessionExtend: true,
|
|
disablePromptLogin: false,
|
|
loginFlag: uint32(common.LoginFlagPromptLogin),
|
|
},
|
|
{
|
|
name: "extend replaces the none flag so the extend is not silent",
|
|
flow: &proto.PKCEAuthorizationFlow{
|
|
ProviderConfig: &proto.ProviderConfig{
|
|
DisablePromptLogin: false,
|
|
LoginFlag: uint32(common.LoginFlagNone),
|
|
},
|
|
},
|
|
sessionExtend: true,
|
|
disablePromptLogin: false,
|
|
loginFlag: uint32(common.LoginFlagPromptLogin),
|
|
},
|
|
{
|
|
name: "extend respects DisablePromptLogin",
|
|
flow: &proto.PKCEAuthorizationFlow{
|
|
ProviderConfig: &proto.ProviderConfig{
|
|
DisablePromptLogin: true,
|
|
LoginFlag: uint32(common.LoginFlagMaxAge0),
|
|
},
|
|
},
|
|
sessionExtend: true,
|
|
disablePromptLogin: true,
|
|
loginFlag: uint32(common.LoginFlagMaxAge0),
|
|
},
|
|
{
|
|
name: "login keeps the configured flow untouched",
|
|
flow: &proto.PKCEAuthorizationFlow{
|
|
ProviderConfig: &proto.ProviderConfig{
|
|
DisablePromptLogin: false,
|
|
LoginFlag: uint32(common.LoginFlagMaxAge0),
|
|
},
|
|
},
|
|
sessionExtend: false,
|
|
disablePromptLogin: false,
|
|
loginFlag: uint32(common.LoginFlagMaxAge0),
|
|
},
|
|
}
|
|
|
|
for _, tc := range tests {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
applySessionExtendFlowPolicy(tc.flow, tc.sessionExtend)
|
|
cfg := tc.flow.GetProviderConfig()
|
|
assert.Equal(t, tc.disablePromptLogin, cfg.GetDisablePromptLogin())
|
|
assert.Equal(t, tc.loginFlag, cfg.GetLoginFlag())
|
|
})
|
|
}
|
|
}
|
|
|
|
// A provider config is not guaranteed to be present on the response; clearing
|
|
// the flag must not panic when the validator returned an empty flow.
|
|
func TestApplySessionExtendFlowPolicyWithoutProviderConfig(t *testing.T) {
|
|
assert.NotPanics(t, func() {
|
|
applySessionExtendFlowPolicy(&proto.PKCEAuthorizationFlow{}, true)
|
|
applySessionExtendFlowPolicy(nil, true)
|
|
})
|
|
}
|