diff --git a/Changelog.md b/Changelog.md index 6aca342250d75caaeb63c15a28be2ab60da3f921..999e99e0a464426f71a805a05cbd139ced1fe74d 100644 --- a/Changelog.md +++ b/Changelog.md @@ -2,6 +2,9 @@ All notable changes to this project will be documented in this file. +## [2.4] - 2024-06-25 +- Fixed the issue with client_credentials grant type token in Authentication part. + ## [2.3] - 2024-06-19 - Changed Modify IP trunk label to Modify ISIS diff --git a/gso/auth/oidc_policy_helper.py b/gso/auth/oidc_policy_helper.py index 96edfbf3e08b21951a320dc40dfb6e1c8012a10e..eca66512a3e6c55cddbc1fd117dee147e1cb62a5 100644 --- a/gso/auth/oidc_policy_helper.py +++ b/gso/auth/oidc_policy_helper.py @@ -239,11 +239,14 @@ class OIDCUser(HTTPBearer): logger.info("User is not active", url=request.url, user_info=intercepted_token) raise HTTPException(status_code=HTTPStatus.UNAUTHORIZED, detail="User is not active") - user_info = await self.userinfo(async_request, token) - - user_info["client_id"] = intercepted_token.get("client_id") + client_id = intercepted_token.get("client_id") + if "sub" not in intercepted_token: + return OIDCUserModel(client_id=client_id) + user_info = await self.userinfo(async_request, token) + user_info["client_id"] = client_id logger.debug("OIDCUserModel object.", intercepted_token=intercepted_token) + return user_info async def check_openid_config(self, async_request: AsyncClient) -> None: diff --git a/setup.py b/setup.py index a722f10fca99f718d48d12abecb8cf0d6c3e5e4a..646364102ed9634cc655a6882a8becf2cf3d02a7 100644 --- a/setup.py +++ b/setup.py @@ -4,7 +4,7 @@ from setuptools import find_packages, setup setup( name="geant-service-orchestrator", - version="2.3", + version="2.4", author="GÉANT Orchestration and Automation Team", author_email="goat@geant.org", description="GÉANT Service Orchestrator", diff --git a/test/auth/test_oidc_policy_helper.py b/test/auth/test_oidc_policy_helper.py index 46b934caad20f93ea55e1f66cd7fa3b9d6694d20..17bed723430d913ef88e1f95f09b7a6b2b6e088d 100644 --- a/test/auth/test_oidc_policy_helper.py +++ b/test/auth/test_oidc_policy_helper.py @@ -237,7 +237,7 @@ def test_evaluate_decision_deny_with_auto_error(): @pytest.mark.asyncio() async def test_oidc_user_call_with_token(oidc_user, mock_request, mock_async_client): - oidc_user.introspect_token = AsyncMock(return_value={"active": True}) + oidc_user.introspect_token = AsyncMock(return_value={"active": True, "sub": "123", "client_id": "test_client"}) oidc_user.userinfo = AsyncMock(return_value=OIDCUserModel({"sub": "123", "name": "John Doe"})) result = await oidc_user.__call__(mock_request, token="test_token") # noqa: S106 @@ -245,11 +245,24 @@ async def test_oidc_user_call_with_token(oidc_user, mock_request, mock_async_cli assert isinstance(result, OIDCUserModel) assert result["sub"] == "123" assert result["name"] == "John Doe" + assert result["client_id"] == "test_client" + + +@pytest.mark.asyncio() +async def test_oidc_user_call_with_client_credential_token(oidc_user, mock_request, mock_async_client): + oidc_user.introspect_token = AsyncMock(return_value={"active": True}) + oidc_user.userinfo = AsyncMock(return_value=OIDCUserModel({"sub": "123", "name": "John Doe"})) + + result = await oidc_user.__call__(mock_request, token="test_token") # noqa: S106 + + assert isinstance(result, OIDCUserModel) + assert result["client_id"] is None + oidc_user.userinfo.assert_not_called() @pytest.mark.asyncio() async def test_oidc_user_call_inactive_token(oidc_user, mock_request, mock_async_client): - oidc_user.introspect_token = AsyncMock(return_value={"active": False}) + oidc_user.introspect_token = AsyncMock(return_value={"active": False, "sub": "123"}) with pytest.raises(HTTPException) as exc_info: await oidc_user.__call__(mock_request, token="test_token") # noqa: S106 @@ -278,7 +291,7 @@ async def test_oidc_user_call_token_from_request(oidc_user, mock_request, mock_a mock_request.state.credentials = Mock() mock_request.state.credentials.credentials = "request_token" - oidc_user.introspect_token = AsyncMock(return_value={"active": True}) + oidc_user.introspect_token = AsyncMock(return_value={"active": True, "sub": "123"}) oidc_user.userinfo = AsyncMock(return_value=OIDCUserModel({"sub": "123", "name": "John Doe"})) result = await oidc_user.__call__(mock_request) # noqa: PLC2801