mirror of
https://github.com/go-gitea/gitea.git
synced 2026-08-09 05:38:54 +09:00
bircni
2bde4fa5d2
Backport #38009 The OAuth2 sign-in callback unconditionally set IsActive=true on the local user row whenever the IdP authenticated them, silently undoing an administrator's "Disable Account" action and granting the user a fresh session in the same response. Treat the local IsActive flag as an authoritative admin override: inactive users get a session and are routed through the existing activate / prohibit-login pages by verifyAuthWithOptions, matching the local-credentials sign-in path. Adds an integration regression test that disables a linked local user and asserts the row stays IsActive=false after a full OIDC callback. Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
270 lines
11 KiB
Go
270 lines
11 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"fmt"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"net/url"
|
|
"testing"
|
|
"time"
|
|
|
|
auth_model "code.gitea.io/gitea/models/auth"
|
|
"code.gitea.io/gitea/models/db"
|
|
"code.gitea.io/gitea/models/unittest"
|
|
user_model "code.gitea.io/gitea/models/user"
|
|
"code.gitea.io/gitea/modules/json"
|
|
"code.gitea.io/gitea/modules/setting"
|
|
"code.gitea.io/gitea/modules/test"
|
|
"code.gitea.io/gitea/services/auth/source/oauth2"
|
|
"code.gitea.io/gitea/tests"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"xorm.io/builder"
|
|
)
|
|
|
|
func TestOIDCIgnoresStaleExternalLoginLinks(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
defer test.MockVariableValue(&setting.OAuth2Client.EnableAutoRegistration, true)()
|
|
defer test.MockVariableValue(&setting.OAuth2Client.AccountLinking, setting.OAuth2AccountLinkingAuto)()
|
|
defer test.MockVariableValue(&setting.OAuth2Client.Username, setting.OAuth2UsernameEmail)()
|
|
|
|
setup := func(t *testing.T, sourceName, sub, userName, email string) (*auth_model.Source, *user_model.User) {
|
|
t.Helper()
|
|
srv := newFakeOIDCServerWithProfile(t, sub, sub+"-oid", email, "OIDC Test User")
|
|
addOAuth2Source(t, sourceName, oauth2.Source{
|
|
Provider: "openidConnect",
|
|
ClientID: "test-client-id",
|
|
ClientSecret: "test-client-secret",
|
|
OpenIDConnectAutoDiscoveryURL: srv.URL + "/.well-known/openid-configuration",
|
|
})
|
|
authSource, err := auth_model.GetActiveOAuth2SourceByAuthName(t.Context(), sourceName)
|
|
require.NoError(t, err)
|
|
correctUser := &user_model.User{Name: userName, Email: email}
|
|
require.NoError(t, user_model.CreateUser(t.Context(), correctUser, &user_model.Meta{}))
|
|
return authSource, correctUser
|
|
}
|
|
|
|
// assertRelinked signs in via OIDC and asserts the stale link now points at the correct individual user.
|
|
assertRelinked := func(t *testing.T, authSource *auth_model.Source, sub string, correctUser *user_model.User) {
|
|
t.Helper()
|
|
doOIDCSignIn(t, authSource.Name)
|
|
// external_login_user has no "id" column, so order by the primary key instead
|
|
externalLink := unittest.AssertExistsAndLoadBean(t, &user_model.ExternalLoginUser{ExternalID: sub, LoginSourceID: authSource.ID}, unittest.OrderBy("external_id ASC"))
|
|
assert.Equal(t, correctUser.ID, externalLink.UserID)
|
|
assert.Equal(t, correctUser.Email, externalLink.Email)
|
|
assert.Equal(t, "OIDC Test User", externalLink.Name)
|
|
}
|
|
|
|
t.Run("organization", func(t *testing.T) {
|
|
const sub, userName, email = "oidc-stale-org-link-sub", "guizar_m", "guizar_m@example.com"
|
|
authSource, correctUser := setup(t, "test-oidc-stale-org-link", sub, userName, email)
|
|
org := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 3, Type: user_model.UserTypeOrganization})
|
|
require.NoError(t, user_model.LinkExternalToUser(t.Context(), org, &user_model.ExternalLoginUser{
|
|
ExternalID: sub,
|
|
UserID: org.ID,
|
|
LoginSourceID: authSource.ID,
|
|
Provider: authSource.Name,
|
|
}))
|
|
assertRelinked(t, authSource, sub, correctUser)
|
|
})
|
|
|
|
t.Run("deleted user", func(t *testing.T) {
|
|
const sub, userName, email = "oidc-stale-deleted-link-sub", "guizar_d", "guizar_d@example.com"
|
|
const deletedUserID = 999999
|
|
authSource, correctUser := setup(t, "test-oidc-stale-deleted", sub, userName, email)
|
|
// link the external account to a user id that does not exist, simulating a deleted user
|
|
require.NoError(t, user_model.LinkExternalToUser(t.Context(), &user_model.User{ID: deletedUserID}, &user_model.ExternalLoginUser{
|
|
ExternalID: sub,
|
|
UserID: deletedUserID,
|
|
LoginSourceID: authSource.ID,
|
|
Provider: authSource.Name,
|
|
}))
|
|
assertRelinked(t, authSource, sub, correctUser)
|
|
})
|
|
}
|
|
|
|
func newFakeOIDCServerWithProfile(t *testing.T, sub, oid, email, name string) *httptest.Server {
|
|
t.Helper()
|
|
|
|
var srv *httptest.Server
|
|
srv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.Header().Set("Content-Type", "application/json")
|
|
switch r.URL.Path {
|
|
case "/.well-known/openid-configuration": // discovery document
|
|
_ = json.NewEncoder(w).Encode(map[string]string{
|
|
"issuer": srv.URL,
|
|
"authorization_endpoint": srv.URL + "/authorize",
|
|
"token_endpoint": srv.URL + "/token",
|
|
"userinfo_endpoint": srv.URL + "/userinfo",
|
|
})
|
|
case "/token": // returns an ID token with both "sub" and "oid" claims so tests can verify which one ends up as ExternalID
|
|
claims := map[string]any{
|
|
"iss": srv.URL,
|
|
"aud": "test-client-id",
|
|
"exp": time.Now().Add(time.Hour).Unix(),
|
|
"sub": sub,
|
|
"oid": oid,
|
|
}
|
|
payload, _ := json.Marshal(claims)
|
|
header := base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"none"}`))
|
|
|
|
// build a JWT-shaped string whose payload encodes claims.
|
|
// goth's decodeJWT only base64-decodes the payload without verifying the signature, so no real signing infrastructure is needed.
|
|
idToken := header + "." + base64.RawURLEncoding.EncodeToString(payload) + ".fakesig"
|
|
|
|
_ = json.NewEncoder(w).Encode(map[string]any{
|
|
"access_token": "fake-access-token",
|
|
"token_type": "Bearer",
|
|
"id_token": idToken,
|
|
})
|
|
case "/userinfo":
|
|
// sub MUST match the id_token sub; goth rejects mismatches.
|
|
_ = json.NewEncoder(w).Encode(map[string]any{
|
|
"sub": sub,
|
|
"email": email,
|
|
"name": name,
|
|
})
|
|
default:
|
|
http.NotFound(w, r)
|
|
}
|
|
}))
|
|
t.Cleanup(srv.Close)
|
|
return srv
|
|
}
|
|
|
|
// TestOAuth2CallbackReactivationGating exercises the gate in handleOAuth2SignIn:
|
|
// an inactive user can only be reactivated when who was disabled by auto-sync
|
|
func TestOAuth2CallbackReactivationGating(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
defer test.MockVariableValue(&setting.OAuth2Client.EnableAutoRegistration, true)()
|
|
defer test.MockVariableValue(&setting.OAuth2Client.Username, setting.OAuth2UsernameUserid)()
|
|
|
|
srv := newFakeOIDCServer(t, FakeOIDCConfig{Sub: "test-sub", Email: "test@example.com", Name: "Test User"})
|
|
addOAuth2Source(t, "test-oauth-source", oauth2.Source{
|
|
Provider: "openidConnect",
|
|
ClientID: "test-client-id",
|
|
ClientSecret: "test-client-secret",
|
|
OpenIDConnectAutoDiscoveryURL: srv.URL + "/.well-known/openid-configuration",
|
|
})
|
|
authSource, err := auth_model.GetActiveOAuth2SourceByAuthName(t.Context(), "test-oauth-source")
|
|
require.NoError(t, err)
|
|
|
|
u := &user_model.User{Name: "test-user", Email: "test@example.com"}
|
|
require.NoError(t, user_model.CreateUser(t.Context(), u, &user_model.Meta{}))
|
|
|
|
extLink := &user_model.ExternalLoginUser{
|
|
UserID: u.ID,
|
|
LoginSourceID: authSource.ID,
|
|
Provider: authSource.Name,
|
|
ExternalID: "test-sub",
|
|
}
|
|
require.NoError(t, user_model.LinkExternalToUser(t.Context(), u, extLink))
|
|
|
|
prepareUserExternalLink := func(t *testing.T, refreshToken string) {
|
|
err := user_model.UpdateUserCols(t.Context(), &user_model.User{ID: u.ID, IsActive: false}, "is_active")
|
|
require.NoError(t, err)
|
|
_, err = db.GetEngine(t.Context()).Where(builder.Eq{"user_id": u.ID}).Cols("refresh_token").
|
|
Update(&user_model.ExternalLoginUser{RefreshToken: refreshToken})
|
|
require.NoError(t, err)
|
|
require.False(t, unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: u.ID}).IsActive)
|
|
}
|
|
|
|
t.Run("admin-disabled user is not reactivated", func(t *testing.T) {
|
|
prepareUserExternalLink(t, "non-empty-refresh-token")
|
|
doOIDCSignIn(t, authSource.Name)
|
|
after := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: u.ID})
|
|
assert.False(t, after.IsActive, "OAuth callback must not re-enable an administrator-disabled account")
|
|
})
|
|
|
|
t.Run("auto-sync-disabled user is reactivated", func(t *testing.T) {
|
|
prepareUserExternalLink(t, "" /* empty refresh token */)
|
|
doOIDCSignIn(t, authSource.Name)
|
|
after := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: u.ID})
|
|
assert.True(t, after.IsActive, "OAuth callback must reactivate a sync-disabled account on successful login")
|
|
})
|
|
}
|
|
|
|
// FakeOIDCConfig holds configuration for the fake OIDC server used in tests.
|
|
type FakeOIDCConfig struct {
|
|
Sub string
|
|
OID string
|
|
Email string
|
|
Name string
|
|
Groups []string
|
|
}
|
|
|
|
// newFakeOIDCServer starts a httptest.Server that implements the minimum OIDC endpoints needed to complete a sign-in flow
|
|
func newFakeOIDCServer(t *testing.T, cfg FakeOIDCConfig) *httptest.Server {
|
|
t.Helper()
|
|
|
|
var srv *httptest.Server
|
|
srv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.Header().Set("Content-Type", "application/json")
|
|
switch r.URL.Path {
|
|
case "/.well-known/openid-configuration": // discovery document
|
|
_ = json.NewEncoder(w).Encode(map[string]string{
|
|
"issuer": srv.URL,
|
|
"authorization_endpoint": srv.URL + "/authorize",
|
|
"token_endpoint": srv.URL + "/token",
|
|
"userinfo_endpoint": srv.URL + "/userinfo",
|
|
})
|
|
case "/token": // returns an ID token with both "sub" and "oid" claims so tests can verify which one ends up as ExternalID
|
|
claims := map[string]any{
|
|
"iss": srv.URL,
|
|
"aud": "test-client-id",
|
|
"exp": time.Now().Add(time.Hour).Unix(),
|
|
"sub": cfg.Sub,
|
|
"oid": cfg.OID,
|
|
}
|
|
payload, _ := json.Marshal(claims)
|
|
header := base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"none"}`))
|
|
|
|
// build a JWT-shaped string whose payload encodes claims.
|
|
// goth's decodeJWT only base64-decodes the payload without verifying the signature, so no real signing infrastructure is needed.
|
|
idToken := header + "." + base64.RawURLEncoding.EncodeToString(payload) + ".fakesig"
|
|
|
|
_ = json.NewEncoder(w).Encode(map[string]any{
|
|
"access_token": "fake-access-token",
|
|
"token_type": "Bearer",
|
|
"id_token": idToken,
|
|
})
|
|
case "/userinfo":
|
|
// sub MUST match the id_token sub; goth rejects mismatches.
|
|
_ = json.NewEncoder(w).Encode(map[string]any{
|
|
"sub": cfg.Sub,
|
|
"email": cfg.Email,
|
|
"name": cfg.Name,
|
|
})
|
|
default:
|
|
http.NotFound(w, r)
|
|
}
|
|
}))
|
|
t.Cleanup(srv.Close)
|
|
return srv
|
|
}
|
|
|
|
// doOIDCSignIn runs a mock OIDC sign-in flow for the given auth source.
|
|
func doOIDCSignIn(t *testing.T, sourceName string) {
|
|
t.Helper()
|
|
session := emptyTestSession(t)
|
|
|
|
// Step 1: initiate login
|
|
resp := session.MakeRequest(t, NewRequest(t, "GET", "/user/oauth2/"+sourceName), http.StatusTemporaryRedirect)
|
|
|
|
// Step 2: extract the UUID state that Gitea embedded in the redirect URL.
|
|
location := resp.Header().Get("Location")
|
|
u, err := url.Parse(location)
|
|
require.NoError(t, err)
|
|
state := u.Query().Get("state")
|
|
require.NotEmpty(t, state, "redirect to OIDC provider must include state")
|
|
|
|
// Step 3: simulate the provider redirecting back.
|
|
callbackURL := fmt.Sprintf("/user/oauth2/%s/callback?code=test-code&state=%s", sourceName, url.QueryEscape(state))
|
|
session.MakeRequest(t, NewRequest(t, "GET", callbackURL), http.StatusSeeOther)
|
|
}
|