Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Openid connect integration tests #49111

Open
jkakavas opened this issue Nov 14, 2019 · 1 comment
Open

Add Openid connect integration tests #49111

jkakavas opened this issue Nov 14, 2019 · 1 comment
Labels
:Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) Team:Security Meta label for security team >test Issues or PRs that are addressing/adding tests

Comments

@jkakavas
Copy link
Member

Given the async nature of openid connect authentication and the back channel communication required with the userinfo and token endpoints, unit tests such as the ones in OpenIdConnectAuthenticatorTests do not provide sufficient coverage.

Currently we only have OpenidConnectAuthenticationIT which uses a live openid provider to perform tests that cover expected functionality with the authentication flows. We should also add additional integration tests that used a mock OP ( a mock http server should suffice) that can create malicious and/or malformed responses and tokens in response to proper requests. This would allow us to verify that our behavior is the proper one in such cases also and help prevent additional bugs such as the one fixed in #49080

@jkakavas jkakavas added >test Issues or PRs that are addressing/adding tests :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) 7x labels Nov 14, 2019
@jkakavas jkakavas self-assigned this Nov 14, 2019
@elasticmachine
Copy link
Collaborator

Pinging @elastic/es-security (:Security/Authentication)

@polyfractal polyfractal removed the 7x label Dec 12, 2019
@rjernst rjernst added the Team:Security Meta label for security team label May 4, 2020
@jkakavas jkakavas removed their assignment Jun 9, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
:Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) Team:Security Meta label for security team >test Issues or PRs that are addressing/adding tests
Projects
None yet
Development

No branches or pull requests

4 participants