Mirror
/
seaweedfs
mirror of https://github.com/seaweedfs/seaweedfs.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Browse Source

update tests

pull/8003/head
Chris Lu 18 hours ago
parent
c1e7a89312
commit
b48cbfc708
7 changed files with 34 additions and 20 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 4
      weed/iam/integration/advanced_policy_test.go
  2. 6
      weed/iam/integration/iam_integration_test.go
  3. 16
      weed/iam/integration/iam_manager.go
  4. 8
      weed/s3api/s3_end_to_end_test.go
  5. 10
      weed/s3api/s3_jwt_auth_test.go
  6. 4
      weed/s3api/s3_multipart_iam_test.go
  7. 6
      weed/s3api/s3_presigned_url_iam_test.go

4
weed/iam/integration/advanced_policy_test.go
View File

@ -25,7 +25,7 @@ func TestPolicyVariableSubstitution(t *testing.T) {
{
Effect: "Allow",
Principal: map[string]interface{}{
"Federated": "https://test-issuer.com",
"Federated": "test-oidc",
},
Action: []string{"sts:AssumeRoleWithWebIdentity"},
},
@ -102,7 +102,7 @@ func TestConditionWithNumericComparison(t *testing.T) {
{
Effect: "Allow",
Principal: map[string]interface{}{
"Federated": "https://test-issuer.com",
"Federated": "test-oidc",
},
Action: []string{"sts:AssumeRoleWithWebIdentity"},
Condition: map[string]map[string]interface{}{

6
weed/iam/integration/iam_integration_test.go
View File

@ -421,7 +421,7 @@ func TestTrustPolicyWildcardPrincipal(t *testing.T) {
{
Effect: "Allow",
Principal: map[string]interface{}{
"Federated": "https://test-issuer.com",
"Federated": "test-oidc",
},
Action: []string{"sts:AssumeRoleWithWebIdentity"},
},
@ -440,7 +440,7 @@ func TestTrustPolicyWildcardPrincipal(t *testing.T) {
{
Effect: "Allow",
Principal: map[string]interface{}{
"Federated": []interface{}{"specific-provider", "https://test-issuer.com"},
"Federated": []interface{}{"specific-provider", "test-oidc"},
},
Action: []string{"sts:AssumeRoleWithWebIdentity"},
},
@ -646,7 +646,7 @@ func setupTestPoliciesAndRoles(t *testing.T, manager *IAMManager) {
{
Effect: "Allow",
Principal: map[string]interface{}{
"Federated": "https://test-issuer.com",
"Federated": "test-oidc",
},
Action: []string{"sts:AssumeRoleWithWebIdentity"},
},

16
weed/iam/integration/iam_manager.go
View File

@ -346,7 +346,7 @@ func (m *IAMManager) ValidateTrustPolicy(ctx context.Context, roleArn, provider,
if principal, ok := statement.Principal.(map[string]interface{}); ok {
if federated, ok := principal["Federated"].(string); ok {
// For OIDC, check against issuer URL
if provider == "oidc" && federated == "https://test-issuer.com" {
if provider == "oidc" && federated == "test-oidc" {
return true
}
// For LDAP, check against test-ldap
@ -391,8 +391,22 @@ func (m *IAMManager) validateTrustPolicyForWebIdentity(ctx context.Context, role
// The issuer is the federated provider for OIDC
if iss, ok := tokenClaims["iss"].(string); ok {
// Default to issuer URL
requestContext["aws:FederatedProvider"] = iss
requestContext["oidc:iss"] = iss
// Try to resolve provider name from issuer for better policy matching
// This allows policies to reference the provider name (e.g. "keycloak") instead of the full issuer URL
if m.stsService != nil {
for name, provider := range m.stsService.GetProviders() {
if oidcProvider, ok := provider.(interface{ GetIssuer() string }); ok {
if oidcProvider.GetIssuer() == iss {
requestContext["aws:FederatedProvider"] = name
break
}
}
}
}
}
if sub, ok := tokenClaims["sub"].(string); ok {

8
weed/s3api/s3_end_to_end_test.go
View File

@ -477,7 +477,7 @@ func setupS3ReadOnlyRole(ctx context.Context, manager *integration.IAMManager) {
{
Effect: "Allow",
Principal: map[string]interface{}{
"Federated": "https://test-issuer.com",
"Federated": "test-oidc",
},
Action: []string{"sts:AssumeRoleWithWebIdentity"},
},
@ -521,7 +521,7 @@ func setupS3AdminRole(ctx context.Context, manager *integration.IAMManager) {
{
Effect: "Allow",
Principal: map[string]interface{}{
"Federated": "https://test-issuer.com",
"Federated": "test-oidc",
},
Action: []string{"sts:AssumeRoleWithWebIdentity"},
},
@ -565,7 +565,7 @@ func setupS3WriteRole(ctx context.Context, manager *integration.IAMManager) {
{
Effect: "Allow",
Principal: map[string]interface{}{
"Federated": "https://test-issuer.com",
"Federated": "test-oidc",
},
Action: []string{"sts:AssumeRoleWithWebIdentity"},
},
@ -614,7 +614,7 @@ func setupS3IPRestrictedRole(ctx context.Context, manager *integration.IAMManage
{
Effect: "Allow",
Principal: map[string]interface{}{
"Federated": "https://test-issuer.com",
"Federated": "test-oidc",
},
Action: []string{"sts:AssumeRoleWithWebIdentity"},
},

10
weed/s3api/s3_jwt_auth_test.go
View File

@ -387,7 +387,7 @@ func setupTestReadOnlyRole(ctx context.Context, manager *integration.IAMManager)
{
Effect: "Allow",
Principal: map[string]interface{}{
"Federated": "https://test-issuer.com",
"Federated": "test-oidc",
},
Action: []string{"sts:AssumeRoleWithWebIdentity"},
},
@ -405,7 +405,7 @@ func setupTestReadOnlyRole(ctx context.Context, manager *integration.IAMManager)
{
Effect: "Allow",
Principal: map[string]interface{}{
"Federated": "https://test-issuer.com",
"Federated": "test-oidc",
},
Action: []string{"sts:AssumeRoleWithWebIdentity"},
},
@ -449,7 +449,7 @@ func setupTestAdminRole(ctx context.Context, manager *integration.IAMManager) {
{
Effect: "Allow",
Principal: map[string]interface{}{
"Federated": "https://test-issuer.com",
"Federated": "test-oidc",
},
Action: []string{"sts:AssumeRoleWithWebIdentity"},
},
@ -467,7 +467,7 @@ func setupTestAdminRole(ctx context.Context, manager *integration.IAMManager) {
{
Effect: "Allow",
Principal: map[string]interface{}{
"Federated": "https://test-issuer.com",
"Federated": "test-oidc",
},
Action: []string{"sts:AssumeRoleWithWebIdentity"},
},
@ -510,7 +510,7 @@ func setupTestIPRestrictedRole(ctx context.Context, manager *integration.IAMMana
{
Effect: "Allow",
Principal: map[string]interface{}{
"Federated": "https://test-issuer.com",
"Federated": "test-oidc",
},
Action: []string{"sts:AssumeRoleWithWebIdentity"},
},

4
weed/s3api/s3_multipart_iam_test.go
View File

@ -568,7 +568,7 @@ func setupTestRolesForMultipart(ctx context.Context, manager *integration.IAMMan
{
Effect: "Allow",
Principal: map[string]interface{}{
"Federated": "https://test-issuer.com",
"Federated": "test-oidc",
},
Action: []string{"sts:AssumeRoleWithWebIdentity"},
},
@ -586,7 +586,7 @@ func setupTestRolesForMultipart(ctx context.Context, manager *integration.IAMMan
{
Effect: "Allow",
Principal: map[string]interface{}{
"Federated": "https://test-issuer.com",
"Federated": "test-oidc",
},
Action: []string{"sts:AssumeRoleWithWebIdentity"},
},

6
weed/s3api/s3_presigned_url_iam_test.go
View File

@ -521,7 +521,7 @@ func setupTestRolesForPresigned(ctx context.Context, manager *integration.IAMMan
{
Effect: "Allow",
Principal: map[string]interface{}{
"Federated": "https://test-issuer.com",
"Federated": "test-oidc",
},
Action: []string{"sts:AssumeRoleWithWebIdentity"},
},
@ -557,7 +557,7 @@ func setupTestRolesForPresigned(ctx context.Context, manager *integration.IAMMan
{
Effect: "Allow",
Principal: map[string]interface{}{
"Federated": "https://test-issuer.com",
"Federated": "test-oidc",
},
Action: []string{"sts:AssumeRoleWithWebIdentity"},
},
@ -575,7 +575,7 @@ func setupTestRolesForPresigned(ctx context.Context, manager *integration.IAMMan
{
Effect: "Allow",
Principal: map[string]interface{}{
"Federated": "https://test-issuer.com",
"Federated": "test-oidc",
},
Action: []string{"sts:AssumeRoleWithWebIdentity"},
},

Write Preview
Loading…
Cancel
Save