tegwick
560cdeed46
The account site said "Not signed in" while Authelia still had a session, and Sign in reused that identity. Ask Authelia who the session cookie is, show that name, and send a fresh sign-in only when a different identity is requested. Assistant: grok Assistant-Session: 01a0d25d-d358-7e13-b84a-d007fbb7e34f
47 lines
2 KiB
Python
47 lines
2 KiB
Python
import unittest
|
|
from urllib.parse import parse_qs, urlparse
|
|
|
|
from user_engine.oidc import BrowserSession, OIDCClient, cookie_value
|
|
|
|
|
|
class OIDCClientTests(unittest.TestCase):
|
|
def setUp(self):
|
|
self.client = OIDCClient(
|
|
issuer="https://kc.example",
|
|
client_id="portal",
|
|
redirect_uri="https://users.example/oidc/callback",
|
|
audience="portal",
|
|
)
|
|
|
|
def test_begin_uses_s256_and_one_time_state(self):
|
|
url = urlparse(self.client.begin())
|
|
query = parse_qs(url.query)
|
|
self.assertEqual(["S256"], query["code_challenge_method"])
|
|
self.assertEqual(["portal"], query["client_id"])
|
|
self.assertIn(query["state"][0], self.client.pending)
|
|
self.assertNotIn(self.client.pending[query["state"][0]].verifier, url.query)
|
|
|
|
def test_fresh_begin_asks_for_a_new_sign_in_without_raising_assurance(self):
|
|
query = parse_qs(urlparse(self.client.begin(fresh=True)).query)
|
|
self.assertEqual(["login"], query["prompt"])
|
|
self.assertEqual(["0"], query["max_age"])
|
|
self.assertNotIn("acr_values", query)
|
|
|
|
def test_begin_can_forward_a_tenant_hint_without_changing_session_authority(self):
|
|
url = urlparse(self.client.begin(tenant_hint="tenant:friendly:binky"))
|
|
self.assertEqual(
|
|
["tenant:friendly:binky"], parse_qs(url.query)["tenant_hint"]
|
|
)
|
|
|
|
def test_opaque_session_and_cookie_parser(self):
|
|
self.client.sessions["opaque"] = BrowserSession(
|
|
claims={"sub": "person"}, expires_at=9999999999
|
|
)
|
|
self.assertEqual("person", self.client.claims("opaque")["sub"])
|
|
self.assertEqual("", self.client.csrf_token("opaque"))
|
|
self.assertEqual("opaque", cookie_value("x=1; ue_session=opaque", "ue_session"))
|
|
self.client.logout("opaque")
|
|
self.assertIsNone(self.client.claims("opaque"))
|
|
|
|
def test_unknown_session_is_rejected(self):
|
|
self.assertIsNone(self.client.claims("not-there"))
|