1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
|
package s3api
import (
"strings"
"testing"
"time"
"github.com/seaweedfs/seaweedfs/weed/iam/integration"
"github.com/seaweedfs/seaweedfs/weed/iam/sts"
"github.com/stretchr/testify/assert"
)
func TestS3IAMIntegration_isSTSIssuer(t *testing.T) {
// Create test STS service with configuration
stsService := sts.NewSTSService()
// Set up STS configuration with a specific issuer
testIssuer := "https://seaweedfs-prod.company.com/sts"
stsConfig := &sts.STSConfig{
Issuer: testIssuer,
SigningKey: []byte("test-signing-key-32-characters-long"),
TokenDuration: sts.FlexibleDuration{time.Hour},
MaxSessionLength: sts.FlexibleDuration{12 * time.Hour}, // Required field
}
// Initialize STS service with config (this sets the Config field)
err := stsService.Initialize(stsConfig)
assert.NoError(t, err)
// Create S3IAM integration with configured STS service
s3iam := &S3IAMIntegration{
iamManager: &integration.IAMManager{}, // Mock
stsService: stsService,
filerAddress: "test-filer:8888",
enabled: true,
}
tests := []struct {
name string
issuer string
expected bool
}{
// Only exact match should return true
{
name: "exact match with configured issuer",
issuer: testIssuer,
expected: true,
},
// All other issuers should return false (exact matching)
{
name: "similar but not exact issuer",
issuer: "https://seaweedfs-prod.company.com/sts2",
expected: false,
},
{
name: "substring of configured issuer",
issuer: "seaweedfs-prod.company.com",
expected: false,
},
{
name: "contains configured issuer as substring",
issuer: "prefix-" + testIssuer + "-suffix",
expected: false,
},
{
name: "case sensitive - different case",
issuer: strings.ToUpper(testIssuer),
expected: false,
},
{
name: "Google OIDC",
issuer: "https://accounts.google.com",
expected: false,
},
{
name: "Azure AD",
issuer: "https://login.microsoftonline.com/tenant-id/v2.0",
expected: false,
},
{
name: "Auth0",
issuer: "https://mycompany.auth0.com",
expected: false,
},
{
name: "Keycloak",
issuer: "https://keycloak.mycompany.com/auth/realms/master",
expected: false,
},
{
name: "Empty string",
issuer: "",
expected: false,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
result := s3iam.isSTSIssuer(tt.issuer)
assert.Equal(t, tt.expected, result, "isSTSIssuer should use exact matching against configured issuer")
})
}
}
func TestS3IAMIntegration_isSTSIssuer_NoSTSService(t *testing.T) {
// Create S3IAM integration without STS service
s3iam := &S3IAMIntegration{
iamManager: &integration.IAMManager{},
stsService: nil, // No STS service
filerAddress: "test-filer:8888",
enabled: true,
}
// Should return false when STS service is not available
result := s3iam.isSTSIssuer("seaweedfs-sts")
assert.False(t, result, "isSTSIssuer should return false when STS service is nil")
}
|
