From ada2a16412f8ddc1e230b764e99fbb5b21f602d3 Mon Sep 17 00:00:00 2001 From: Jens Langhammer Date: Sun, 5 Dec 2021 11:17:57 +0100 Subject: [PATCH] tests/e2e: add post binding test Signed-off-by: Jens Langhammer --- authentik/providers/saml/api.py | 4 +- tests/e2e/test_provider_saml.py | 97 ++++++++++++++++++++++++++++++--- 2 files changed, 90 insertions(+), 11 deletions(-) diff --git a/authentik/providers/saml/api.py b/authentik/providers/saml/api.py index 33a524e0f..71f714bc9 100644 --- a/authentik/providers/saml/api.py +++ b/authentik/providers/saml/api.py @@ -119,9 +119,7 @@ class SAMLProviderViewSet(UsedByMixin, ModelViewSet): SAML_BINDING_REDIRECT, SAML_BINDING_POST, ], - description=( - "Optionally force the metadata to only include one binding." - ) + description=("Optionally force the metadata to only include one binding."), ), ], ) diff --git a/tests/e2e/test_provider_saml.py b/tests/e2e/test_provider_saml.py index 336614d8d..147e742d0 100644 --- a/tests/e2e/test_provider_saml.py +++ b/tests/e2e/test_provider_saml.py @@ -16,6 +16,7 @@ from authentik.flows.models import Flow from authentik.policies.expression.models import ExpressionPolicy from authentik.policies.models import PolicyBinding from authentik.providers.saml.models import SAMLBindings, SAMLPropertyMapping, SAMLProvider +from authentik.sources.saml.processors.constants import SAML_BINDING_POST from tests.e2e.utils import SeleniumTestCase, apply_migration, object_manager, retry @@ -25,9 +26,18 @@ class TestProviderSAML(SeleniumTestCase): container: Container - def setup_client(self, provider: SAMLProvider) -> Container: + def setup_client(self, provider: SAMLProvider, force_post: bool = False) -> Container: """Setup client saml-sp container which we test SAML against""" client: DockerClient = from_env() + metadata_url = ( + self.url( + "authentik_api:samlprovider-metadata", + pk=provider.pk, + ) + + "?download" + ) + if force_post: + metadata_url += f"&force_binding={SAML_BINDING_POST}" container = client.containers.run( image="beryju.org/saml-test-sp:latest", detach=True, @@ -41,13 +51,7 @@ class TestProviderSAML(SeleniumTestCase): environment={ "SP_ENTITY_ID": provider.issuer, "SP_SSO_BINDING": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST", - "SP_METADATA_URL": ( - self.url( - "authentik_api:samlprovider-metadata", - pk=provider.pk, - ) - + "?download" - ), + "SP_METADATA_URL": metadata_url, }, ) while True: @@ -197,6 +201,83 @@ class TestProviderSAML(SeleniumTestCase): [self.user.email], ) + @retry() + @apply_migration("authentik_flows", "0008_default_flows") + @apply_migration("authentik_flows", "0011_flow_title") + @apply_migration("authentik_flows", "0010_provider_flows") + @apply_migration("authentik_crypto", "0002_create_self_signed_kp") + @object_manager + def test_sp_initiated_explicit_post(self): + """test SAML Provider flow SP-initiated flow (explicit consent) (POST binding)""" + # Bootstrap all needed objects + authorization_flow = Flow.objects.get( + slug="default-provider-authorization-explicit-consent" + ) + provider: SAMLProvider = SAMLProvider.objects.create( + name="saml-test", + acs_url="http://localhost:9009/saml/acs", + audience="authentik-e2e", + issuer="authentik-e2e", + sp_binding=SAMLBindings.POST, + authorization_flow=authorization_flow, + signing_kp=create_test_cert(), + ) + provider.property_mappings.set(SAMLPropertyMapping.objects.all()) + provider.save() + app = Application.objects.create( + name="SAML", + slug="authentik-saml", + provider=provider, + ) + self.container = self.setup_client(provider, True) + self.driver.get("http://localhost:9009") + self.login() + + self.wait.until(ec.presence_of_element_located((By.CSS_SELECTOR, "ak-flow-executor"))) + + flow_executor = self.get_shadow_root("ak-flow-executor") + consent_stage = self.get_shadow_root("ak-stage-consent", flow_executor) + + self.assertIn( + app.name, + consent_stage.find_element(By.CSS_SELECTOR, "#header-text").text, + ) + consent_stage.find_element( + By.CSS_SELECTOR, + ("[type=submit]"), + ).click() + + self.wait_for_url("http://localhost:9009/") + + body = loads(self.driver.find_element(By.CSS_SELECTOR, "pre").text) + + self.assertEqual( + body["attr"]["http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"], + [self.user.name], + ) + self.assertEqual( + body["attr"][ + "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname" + ], + [self.user.username], + ) + self.assertEqual( + body["attr"]["http://schemas.goauthentik.io/2021/02/saml/username"], + [self.user.username], + ) + self.assertEqual( + body["attr"]["http://schemas.goauthentik.io/2021/02/saml/uid"], + [str(self.user.pk)], + ) + self.assertEqual( + body["attr"]["http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"], + [self.user.email], + ) + self.assertEqual( + body["attr"]["http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"], + [self.user.email], + ) + @retry() @apply_migration("authentik_flows", "0008_default_flows") @apply_migration("authentik_flows", "0011_flow_title")