Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(auth/middleware): only enforce email matches on OIDC method tokens #1934

Merged
merged 2 commits into from
Aug 1, 2023

Conversation

GeorgeMac
Copy link
Contributor

@GeorgeMac GeorgeMac commented Aug 1, 2023

Fixes an issue where when OIDC is used in conjunction with other authentication methods (Token, Kubernetes etc.) with the new email matches feature, we end up inadvertantly rejecting all non-OIDC method generated tokens.

The email matches feature should only be enforced on authentication tokens generated with the OIDC method.

From the newly added test around this behaviour:

    --- FAIL: TestEmailMatchingInterceptor/successful_token_was_not_generated_via_OIDC_method (0.00s)
        logger.go:130: 2023-08-01T14:41:44.690Z	DEBUG	no email provided but required for auth
        middleware_test.go:281: 
            	Error Trace:	/src/internal/server/auth/middleware_test.go:281
            	Error:      	Not equal: 
            	            	expected: <nil>(<nil>)
            	            	actual  : *status.Error(&status.Error{s:(*status.Status)(0xc0000143d8)})
            	Test:       	TestEmailMatchingInterceptor/successful_token_was_not_generated_via_OIDC_method

This is a authentication token created as a static token failing because of email matches which only should apply to client token generated with the OIDC method.

@GeorgeMac GeorgeMac changed the title test(auth/middleware): add failing test for email matches non-oidc fix(auth/middleware): only enforce email matches on OIDC method tokens Aug 1, 2023
@codecov
Copy link

codecov bot commented Aug 1, 2023

Codecov Report

Merging #1934 (de57a17) into main (9c08bc5) will increase coverage by 0.01%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##             main    #1934      +/-   ##
==========================================
+ Coverage   71.35%   71.36%   +0.01%     
==========================================
  Files          66       66              
  Lines        6455     6458       +3     
==========================================
+ Hits         4606     4609       +3     
  Misses       1592     1592              
  Partials      257      257              
Files Changed Coverage Δ
internal/server/auth/middleware.go 90.17% <100.00%> (+0.27%) ⬆️

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

@GeorgeMac GeorgeMac marked this pull request as ready for review August 1, 2023 14:48
@GeorgeMac GeorgeMac requested a review from a team as a code owner August 1, 2023 14:48
@GeorgeMac GeorgeMac merged commit 7acd683 into main Aug 1, 2023
23 checks passed
@GeorgeMac GeorgeMac deleted the gm/fix-email-matches-method branch August 1, 2023 14:56
yquansah pushed a commit that referenced this pull request Aug 4, 2023
#1934)

* test(auth/middleware): add failing test for email matches non-oidc

* fix(auth/middleware): only enforce email matches on OIDC method tokens
markphelps pushed a commit that referenced this pull request Aug 7, 2023
#1934)

* test(auth/middleware): add failing test for email matches non-oidc

* fix(auth/middleware): only enforce email matches on OIDC method tokens
markphelps added a commit that referenced this pull request Aug 7, 2023
* fix(auth/middleware): only enforce email matches on OIDC method tokens  (#1934)

* test(auth/middleware): add failing test for email matches non-oidc

* fix(auth/middleware): only enforce email matches on OIDC method tokens

* chore: update v1.24 changelog

* chore: mv line

---------

Co-authored-by: George <me@georgemac.com>
markphelps added a commit that referenced this pull request Aug 7, 2023
* release/1.24:
  chore: Update 1.24 changelog (#1969)
  fix(auth/middleware): only enforce email matches on OIDC method tokens  (#1934)
  fix(ui): rule form inputs in darkmode (#1968)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants