| Safe Haskell | None |
|---|---|
| Language | GHC2021 |
Test.Spar.MultiIngressCrossIdpSso
Synopsis
- ernieDomain :: String
- bertDomain :: String
- ernieZHost :: String
- bertZHost :: String
- testCrossIdpSsoMigration :: HasCallStack => TaggedBool "useScim" -> App ()
- testScimUserLoginsDifferentIdP :: HasCallStack => App ()
- testIdpNotFoundError :: HasCallStack => App ()
- testCrossTeamIdpLoginRejected :: HasCallStack => App ()
- testNonEmailNameIdRejectedInMultiIngress :: HasCallStack => App ()
- testUnsolicitedSamlResponseRejected :: HasCallStack => App ()
- testCrossIngressRequestResponseMismatch :: HasCallStack => App ()
- withMultiIngressBackend :: HasCallStack => [String] -> [SignedCertificate] -> (String -> App ()) -> App ()
- buildSamlAuthnResponse :: (HasCallStack, MakesValue domain) => domain -> String -> String -> String -> IdPMetadata -> SignPrivCreds -> NameID -> App SignedAuthnResponse
Documentation
ernieDomain :: String Source #
bertDomain :: String Source #
ernieZHost :: String Source #
testCrossIdpSsoMigration :: HasCallStack => TaggedBool "useScim" -> App () Source #
Test that - in a multi-ingress scenario - a user provisioned under one IdP can log in via another IdP, with their SSO identity migrating to the new IdP transparently.
Covers both SCIM-provisioned and auto-provisioned users, and verifies back-and-forth migration between IdPs.
testScimUserLoginsDifferentIdP :: HasCallStack => App () Source #
Cross-IdP migration works even when the user's first SSO login is on a different IdP than the one they were SCIM-provisioned under.
testIdpNotFoundError :: HasCallStack => App () Source #
Login fails when the authenticating IdP's issuer is not registered for the target domain.
testCrossTeamIdpLoginRejected :: HasCallStack => App () Source #
Test that a user of one team cannot log in using the IdP of a different team.
Team B's IdP must not grant access to Team A, even when the SAML response is otherwise well-formed.
testNonEmailNameIdRejectedInMultiIngress :: HasCallStack => App () Source #
Test that non-email NameIDs are rejected in multi-ingress mode.
Multi-ingress cross-IdP SSO requires email-based NameIDs to prevent ambiguities.
testUnsolicitedSamlResponseRejected :: HasCallStack => App () Source #
Test that SAML responses without a prior authentication request are rejected.
A response referencing a request Spar never stored results in a "bad InResponseTo" error.
testCrossIngressRequestResponseMismatch :: HasCallStack => App () Source #
Test that SAML responses for one ingress are rejected when submitted to a different ingress.
A login request on the ernie ingress must be finalized on the ernie ingress. Finalizing on the bert ingress should fail with a bad recipient error.
withMultiIngressBackend :: HasCallStack => [String] -> [SignedCertificate] -> (String -> App ()) -> App () Source #
Run a test with the standard multi-ingress backend configuration. Takes base domain names (e.g. "ernie.example.com"); the ZHost and SSO/webapp URLs are derived from each base domain. Optionally accepts IdP certificates to add to the allowlist.
buildSamlAuthnResponse :: (HasCallStack, MakesValue domain) => domain -> String -> String -> String -> IdPMetadata -> SignPrivCreds -> NameID -> App SignedAuthnResponse Source #
Initiate a SAML login and build a signed authn response for the given NameID. Use this when testing error cases that require manual control over the finalize step.