crates/gunnar-server/tests/sso.rs
//! **Company SSO, end to end** (owner, 2026-10-05): the `Sso` service over the
//! REAL plane and stores, against a fake OpenID provider and a fake SAML IdP
//! running in this process over real HTTP (`nornir_auth_oidc::fake_op`,
//! `nornir_auth_saml::fake_idp`), reached through gunnar's own egress.
//!
//! What must hold, each its own test:
//! * the happy path, both protocols: verified by gunnar, a NEW employee of
//! THAT account just in time, the session key the person's;
//! * every refusal — wrong audience, expired, bad signature (another key, the
//! HS256 confusion), the replayed state, the replayed assertion, the wrong
//! nonce, another account's IdP — creates nobody and enrols nothing;
//! * an existing principal is never attached;
//! * `require_sso` refuses an employee's passkey-only login, and the account
//! admin keeps the break-glass; `require_passkey` puts a passkey after the
//! IdP (registered on the first login);
//! * SCIM create/update/deactivate/delete and groups, and the CSV import;
//! * the client secret and the SCIM bearer never come back and are never in
//! an audit record.
#![cfg(feature = "sso-egress")] // A32-18: the airgap default carries no HTTP client; the appliance rows and CI name `sso-egress`.
use std::sync::{Arc, Mutex};
use gunnar_grpc::auth::{AuditLedger, AuditRecord, AuthGate, PersonSession, SESSION_METADATA_KEY};
use gunnar_grpc::identity::GunnarIdentity;
use gunnar_grpc::{Caller, ControlPlane, EventBus, ServerConfig, ServiceContext, SsoService};
use gunnar_proto::access_server::Access as _;
use gunnar_proto::sso_server::Sso as _;
use gunnar_proto::*;
use gunnar_server::control_plane::CoreControlPlane;
use gunnar_server::stores::ServerStores;
use nornir_auth_oidc::fake_op::{self, FakeOp};
use nornir_auth_saml::fake_idp::{self, FakeIdp};
use p256::ecdsa::signature::Signer as _;
use sha2::Digest as _;
use tonic::{Code, Request};
const ORIGIN: &str = "http://localhost:7000";
const RP_ID: &str = "localhost";
const SECRET: &str = "oidc-client-secret-NEVER-LOGGED";
#[derive(Default)]
struct Ledger(Mutex<Vec<String>>);
impl AuditLedger for Ledger {
fn record(&self, r: AuditRecord<'_>) {
self.0.lock().unwrap().push(format!(
"{} principal={} scope={} {} {}",
r.method, r.principal, r.scope, r.decision, r.reason
));
}
}
struct Harness {
_dir: tempfile::TempDir,
plane: Arc<CoreControlPlane>,
identity: Arc<GunnarIdentity>,
stores: Arc<ServerStores>,
ctx: ServiceContext,
ledger: Arc<Ledger>,
console: Caller,
op: FakeOp,
}
fn person(id: &str) -> Caller {
Caller {
principal_id: id.to_owned(),
fingerprint: String::new(),
machine: false,
authenticated: true,
}
}
/// A call from `caller`. A test person with no fingerprint stands for a
/// session that stepped up a moment ago (a fresh user-verified touch, the
/// identity core's [`PersonSession`]); one with a fingerprint, for one that
/// did not (`a34_10_…`).
fn authed<T>(caller: &Caller, body: T) -> Request<T> {
let mut r = Request::new(body);
r.extensions_mut().insert(caller.clone());
r.extensions_mut().insert(PersonSession {
stepped_up: caller.fingerprint.is_empty(),
stepped_up_at_unix_ms: None,
});
r
}
/// The browser's relying party, as the console relays it to the core.
fn relay() -> nornir_identity::Relay {
nornir_identity::Relay {
rp_id: RP_ID.into(),
origin: ORIGIN.into(),
client: None,
}
}
fn now_ms() -> i64 {
gunnar_core::now_ms()
}
/// A fresh OpenSSH public key (an SSH key a person adds).
fn session() -> (String, ()) {
let key =
gunnar_core::ssh_key::PrivateKey::from_openssh(gunnar_core::mint_ed25519().expect("mint"))
.expect("parses");
(key.public_key().to_openssh().expect("openssh"), ())
}
fn query(url: &str, key: &str) -> String {
url.split_once('?')
.map(|(_, q)| q)
.unwrap_or("")
.split('&')
.filter_map(|p| p.split_once('='))
.find(|(k, _)| *k == key)
.map(|(_, v)| {
let mut out = Vec::new();
let b = v.as_bytes();
let mut i = 0;
while i < b.len() {
if b[i] == b'%' && i + 2 < b.len() {
out.push(u8::from_str_radix(&v[i + 1..i + 3], 16).unwrap());
i += 3;
} else {
out.push(if b[i] == b'+' { b' ' } else { b[i] });
i += 1;
}
}
String::from_utf8(out).unwrap()
})
.unwrap_or_default()
}
impl Harness {
fn new() -> Harness {
let dir = tempfile::tempdir().expect("tempdir");
let stores = Arc::new(ServerStores::open(dir.path()).expect("stores"));
let plane = Arc::new(CoreControlPlane::new(Arc::clone(&stores)));
let control: Arc<dyn ControlPlane> = plane.clone();
let ledger = Arc::new(Ledger::default());
let identity = gunnar_server::identity::build(
dir.path(),
Arc::clone(&control),
&ServerConfig::default(),
false,
);
let ctx = ServiceContext::new(
control,
Arc::new(EventBus::new(16)),
ServerConfig::default(),
)
.with_audit_ledger(ledger.clone())
.with_identity(Arc::clone(&identity));
ctx.sso.set_allow_loopback_http(true);
ctx.sso
.set_egress(Arc::new(gunnar_server::sso_egress::UreqEgress::new(true)));
// The operator's switch (A34-16): this rig dials its IdP.
ctx.sso.set_egress_on(true);
plane
.add_principal("gunnar-ui", "gunnar-ui", PrincipalKind::Machine)
.expect("console");
plane
.grant("gunnar-ui", "", "", GrantLevel::Admin)
.expect("the relay is a server admin");
for account in ["acme", "globex"] {
plane
.add_principal(account, account, PrincipalKind::User)
.expect("account");
}
let op = FakeOp::start("gunnar-acme", SECRET).expect("fake OP");
Harness {
_dir: dir,
plane,
identity,
stores,
ctx,
ledger,
console: Caller {
principal_id: "gunnar-ui".into(),
fingerprint: String::new(),
machine: true,
authenticated: true,
},
op,
}
}
fn sso(&self) -> SsoService {
SsoService::new(self.ctx.clone())
}
fn oidc_provider(
&self,
account: &str,
require_sso: bool,
require_passkey: bool,
) -> SsoProvider {
SsoProvider {
account: account.into(),
protocol: SsoProtocol::Oidc as i32,
display_name: format!("{account} corp"),
domains: vec![format!("{account}.example")],
oidc: Some(OidcSettings {
issuer: self.op.issuer().to_owned(),
client_id: "gunnar-acme".into(),
..Default::default()
}),
saml: None,
require_sso,
require_passkey,
console_origin: ORIGIN.into(),
..Default::default()
}
}
async fn configure(&self, provider: SsoProvider) -> ProviderView {
let account = provider.account.clone();
self.sso()
.set_provider(authed(
&person(&account),
SetProviderRequest {
provider: Some(provider),
client_secret: SECRET.into(),
clear_client_secret: false,
clear_idp_ca: false,
},
))
.await
.expect("the account admin configures the IdP")
.into_inner()
.view
.expect("a view")
}
async fn begin(&self, account: &str) -> BeginResponse {
self.sso()
.begin(authed(
&self.console,
BeginRequest {
account: account.into(),
login_hint: String::new(),
console_origin: ORIGIN.into(),
client: String::new(),
},
))
.await
.expect("begun")
.into_inner()
}
async fn finish_oidc(&self, state: &str, code: &str) -> Result<FinishResponse, tonic::Status> {
self.sso()
.finish(authed(
&self.console,
FinishRequest {
state: state.into(),
code: code.into(),
console_origin: ORIGIN.into(),
..Default::default()
},
))
.await
.map(|r| r.into_inner())
}
/// One whole OIDC sign-in as `who`, through the fake: the finish, and the
/// identity-core session it handed (empty when a second factor is owed).
async fn oidc_login(
&self,
account: &str,
who: fake_op::Person,
) -> (Result<FinishResponse, tonic::Status>, String) {
self.op.set_person(who);
let begun = self.begin(account).await;
let back = self
.op
.authorize(&begun.redirect_url)
.expect("the fake signs in");
assert_eq!(query(&back, "state"), begun.state, "the state comes back");
let finished = self.finish_oidc(&begun.state, &query(&back, "code")).await;
let session = finished
.as_ref()
.map(|f| f.session.clone())
.unwrap_or_default();
(finished, session)
}
fn employees(&self, account: &str) -> Vec<String> {
self.plane
.employees(account)
.expect("employees")
.into_iter()
.map(|p| p.id)
.collect()
}
fn audit(&self) -> Vec<String> {
self.ledger.0.lock().unwrap().clone()
}
/// `Sso.ImportUsers`, then `Sso.ImportStatus` until the job has ended
/// (A34-17: the import is a background job).
async fn import_as(
&self,
caller: &Caller,
account: &str,
csv: &str,
dry_run: bool,
) -> Result<ImportUsersResponse, tonic::Status> {
let mut job = self
.sso()
.import_users(authed(
caller,
ImportUsersRequest {
account: account.into(),
csv: csv.into(),
dry_run,
},
))
.await?
.into_inner();
for _ in 0..500 {
if job.state == "done" || job.state == "failed" {
return Ok(job);
}
tokio::time::sleep(std::time::Duration::from_millis(10)).await;
job = self
.sso()
.import_status(authed(
caller,
ImportStatusRequest {
account: account.into(),
job_id: job.job_id.clone(),
},
))
.await?
.into_inner();
}
panic!("the import job never ended: {job:?}");
}
/// **Prove `domain` for `account`** (A34-5): a DNS-over-HTTPS resolver on this
/// box's loopback answers the account's TXT record, and the admin asks.
async fn prove(&self, account: &str, domain: &str) -> Result<ProviderView, tonic::Status> {
let record = gunnar_grpc::sso::domains::proof_value(account, domain);
self.ctx.sso.set_dns_resolver(&doh_server(vec![record]));
self.verify_domain(account, domain).await
}
async fn verify_domain(
&self,
account: &str,
domain: &str,
) -> Result<ProviderView, tonic::Status> {
self.sso()
.verify_domain(authed(
&person(account),
VerifyDomainRequest {
account: account.into(),
domain: domain.into(),
},
))
.await
.map(|r| r.into_inner().view.expect("a view"))
}
}
/// A DNS-over-HTTPS JSON resolver on the loopback, answering `records` as the TXT
/// strings of whatever name is asked. Its URL.
fn doh_server(records: Vec<String>) -> String {
use std::io::{Read as _, Write as _};
let listener = std::net::TcpListener::bind("127.0.0.1:0").expect("a loopback port");
let url = format!("http://{}/resolve", listener.local_addr().unwrap());
let answers: Vec<serde_json::Value> = records
.iter()
.map(|r| serde_json::json!({ "type": 16, "data": format!("\"{r}\"") }))
.collect();
let body = serde_json::json!({ "Status": 0, "Answer": answers }).to_string();
std::thread::spawn(move || {
for stream in listener.incoming().flatten() {
let mut stream = stream;
let mut buf = [0u8; 4096];
let _ = stream.read(&mut buf);
let _ = write!(stream, "HTTP/1.1 200 OK\r\nContent-Type: application/dns-json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}", body.len());
}
});
url
}
/// ★ **Whether ANY account has an identity provider — and nothing more**
/// (round 5.3, owner 2026-10-08: test2's login page offered "Work email or
/// company account" on an estate where no account has an IdP). Discover
/// answers `any_provider` for every hint, the empty one included: false on a
/// box with no provider, true once one account configures one, false again
/// when it is removed. The empty hint still finds nobody and names no account.
#[tokio::test(flavor = "multi_thread")]
async fn discover_says_whether_any_account_has_an_identity_provider() {
let h = Harness::new();
let ask = |hint: &str| {
let req = authed(&h.console, DiscoverRequest { hint: hint.into() });
let sso = h.sso();
async move {
sso.discover(req)
.await
.expect("discover answers")
.into_inner()
}
};
let none = ask("").await;
assert!(
!none.any_provider && !none.found && none.account.is_empty(),
"no provider anywhere: {none:?}"
);
assert!(
!ask("bob@acme.example").await.any_provider,
"a hint changes nothing while none is configured"
);
h.configure(h.oidc_provider("acme", false, false)).await;
h.prove("acme", "acme.example")
.await
.expect("acme proves its domain");
let any = ask("").await;
assert!(any.any_provider, "acme has a provider: {any:?}");
assert!(
!any.found && any.account.is_empty() && any.display_name.is_empty(),
"the empty hint names no account: {any:?}"
);
let other = ask("someone@elsewhere.example").await;
assert!(
other.any_provider && !other.found,
"a hint that finds nobody still says one exists: {other:?}"
);
assert!(ask("bob@acme.example").await.found);
h.sso()
.remove_provider(authed(
&person("acme"),
RemoveProviderRequest {
account: "acme".into(),
},
))
.await
.expect("the account admin removes it");
assert!(
!ask("").await.any_provider,
"the last provider removed: none any more"
);
}
fn bob() -> fake_op::Person {
fake_op::Person::new("00u-bob", "bob@acme.example", "Bob Example")
}
/// ★ **OIDC, the happy path.** gunnar verifies the IdP's answer, creates a NEW
/// employee of acme just in time, and the console's session key is that
/// employee's — it authenticates as them. The second login is the same
/// person. The client secret never comes back.
#[tokio::test(flavor = "multi_thread")]
async fn oidc_first_login_creates_a_new_employee_and_the_session_is_theirs() {
let h = Harness::new();
let view = h.configure(h.oidc_provider("acme", false, false)).await;
let shown = view.provider.expect("provider");
assert!(shown.has_client_secret);
assert_eq!(
view.redirect_uri,
format!("{ORIGIN}/auth/sso/oidc/callback")
);
let got = h
.sso()
.get_provider(authed(
&person("acme"),
GetProviderRequest {
account: "acme".into(),
..Default::default()
},
))
.await
.unwrap()
.into_inner();
assert!(
!format!("{got:?}").contains(SECRET),
"the client secret came back"
);
h.prove("acme", "acme.example")
.await
.expect("acme proves its domain");
let found = h
.sso()
.discover(authed(
&h.console,
DiscoverRequest {
hint: "Bob@ACME.example".into(),
},
))
.await
.unwrap()
.into_inner();
assert!(
found.found && found.account == "acme" && found.display_name == "acme corp",
"{found:?}"
);
let (first, key) = h.oidc_login("acme", bob()).await;
let first = first.expect("the first login");
let employee = first.principal.as_ref().unwrap().id.clone();
assert!(first.created);
assert_eq!(employee, "acme.bob");
assert_eq!(
h.stores.auth().employer_of(&employee).unwrap().as_deref(),
Some("acme")
);
assert_eq!(first.session, key);
assert_eq!(
h.gate_session(&key)
.expect("the core session is a credential")
.principal_id,
"acme.bob",
"the session is the employee's"
);
let (second, _) = h.oidc_login("acme", bob()).await;
let second = second.expect("the second login");
assert!(!second.created);
assert_eq!(second.principal.unwrap().id, "acme.bob");
assert_eq!(h.employees("acme"), vec!["acme.bob".to_owned()]);
let trail = h.audit().join("\n");
assert!(
trail.contains("Sso.SetProvider principal=acme scope=account:acme allow"),
"{trail}"
);
assert!(
trail.contains("Sso.Finish principal=acme.bob scope=account:acme allow")
&& trail.contains("created=true"),
"{trail}"
);
assert!(
!trail.contains(SECRET),
"the client secret reached the audit trail"
);
// ★ The ACCOUNT's own log (the owner's enterprise list, 2026-10-05): the
// provider its admin set, and each sign-in of its employee through it.
let log = h
.stores
.account_audit()
.query(
"acme",
&gunnar_core::account_audit::AuditQuery {
limit: 100,
..Default::default()
},
)
.expect("acme's log");
let seen: Vec<String> = log
.entries
.iter()
.map(|e| format!("{}:{}:{}", e.kind, e.actor, e.actor_role))
.collect();
assert!(
seen.iter().any(|s| s == "sso.provider_set:acme:admin"),
"{seen:#?}"
);
assert_eq!(
seen.iter()
.filter(|s| *s == "login:acme.bob:member")
.count(),
2,
"{seen:#?}"
);
assert!(
log.entries
.iter()
.filter(|e| e.kind == "login")
.all(|e| e.target == "sso" && !e.detail.contains(SECRET)),
"{:#?}",
log.entries
);
}
/// ★ **Each broken token is refused, and nothing is created or enrolled.**
#[tokio::test(flavor = "multi_thread")]
async fn a_broken_id_token_creates_nobody() {
let h = Harness::new();
h.configure(h.oidc_provider("acme", false, false)).await;
for (tweak, words) in [
(fake_op::Tweak::WrongAudience, "audience"),
(fake_op::Tweak::Expired, "expired"),
(fake_op::Tweak::ForeignKey, "does not verify"),
(fake_op::Tweak::HmacConfusion, "not allowed"),
(fake_op::Tweak::WrongNonce, "nonce"),
(fake_op::Tweak::WrongIssuer, "issuer"),
] {
h.op.tweak_next(tweak);
let (answer, _) = h.oidc_login("acme", bob()).await;
let err = answer.expect_err(&format!("{tweak:?} was accepted"));
assert_eq!(err.code(), Code::PermissionDenied, "{tweak:?}: {err:?}");
assert!(
err.message().contains(words),
"{tweak:?}: {}",
err.message()
);
assert_eq!(h.sessions(), 0, "{tweak:?} minted a session");
}
assert!(
h.employees("acme").is_empty(),
"a refused login created an employee"
);
assert!(
h.audit()
.iter()
.filter(|l| l.contains("Sso.Finish") && l.contains(" deny "))
.count()
>= 6
);
}
/// ★ **Replay**: the state is single use (a second finish with it is refused
/// even with a fresh code), and the IdP's code is single use too.
#[tokio::test(flavor = "multi_thread")]
async fn a_replayed_state_or_code_is_refused() {
let h = Harness::new();
h.configure(h.oidc_provider("acme", false, false)).await;
h.op.set_person(bob());
let begun = h.begin("acme").await;
let back = h.op.authorize(&begun.redirect_url).unwrap();
h.finish_oidc(&begun.state, &query(&back, "code"))
.await
.expect("once");
let err = h
.finish_oidc(&begun.state, &query(&back, "code"))
.await
.expect_err("twice");
assert_eq!(err.code(), Code::PermissionDenied);
assert!(err.message().contains("already used"), "{}", err.message());
// A fresh state with the spent code: the IdP refuses the code.
let begun = h.begin("acme").await;
let err = h
.finish_oidc(&begun.state, &query(&back, "code"))
.await
.expect_err("a spent code");
assert!(err.message().contains("invalid_grant"), "{}", err.message());
}
/// ★ **Never across accounts.** A sign-in begun for acme cannot be finished
/// with globex's identity provider's answer (another issuer), and acme's
/// employee is not globex's: the same IdP subject in globex is a NEW person
/// there.
#[tokio::test(flavor = "multi_thread")]
async fn a_subject_from_another_account_is_refused_and_never_shared() {
let h = Harness::new();
h.configure(h.oidc_provider("acme", false, false)).await;
let globex_op = FakeOp::start("gunnar-acme", SECRET).unwrap();
let mut globex = h.oidc_provider("globex", false, false);
globex.oidc.as_mut().unwrap().issuer = globex_op.issuer().to_owned();
h.configure(globex).await;
// Begun for acme, answered by globex's IdP: its code is not acme's IdP's.
let begun = h.begin("acme").await;
let foreign = globex_op
.authorize(
&begun
.redirect_url
.replace(h.op.issuer(), globex_op.issuer()),
)
.unwrap();
let err = h
.finish_oidc(&begun.state, &query(&foreign, "code"))
.await
.expect_err("globex's code at acme");
assert_eq!(err.code(), Code::PermissionDenied, "{err:?}");
assert!(h.employees("acme").is_empty());
let (a, _) = h.oidc_login("acme", bob()).await;
let a = a.unwrap().principal.unwrap().id;
globex_op.set_person(bob());
let begun = h.begin("globex").await;
let back = globex_op.authorize(&begun.redirect_url).unwrap();
let g = h
.finish_oidc(&begun.state, &query(&back, "code"))
.await
.unwrap();
let g_id = g.principal.unwrap().id;
assert!(g.created);
assert_ne!(a, g_id);
assert_eq!(
h.stores.auth().employer_of(&g_id).unwrap().as_deref(),
Some("globex")
);
}
/// ★ **An existing principal is never attached.** A user `acme.bob` that is
/// not acme's (a stranger on this server) is passed over: the IdP's bob is a
/// NEW employee `acme.bob-2`.
#[tokio::test(flavor = "multi_thread")]
async fn an_existing_principal_is_never_attached() {
let h = Harness::new();
h.plane
.add_principal("acme.bob", "acme.bob", PrincipalKind::User)
.expect("a stranger");
h.configure(h.oidc_provider("acme", false, false)).await;
let (answer, _) = h.oidc_login("acme", bob()).await;
let answer = answer.unwrap();
assert_eq!(answer.principal.unwrap().id, "acme.bob-2");
assert_eq!(
h.stores.auth().employer_of("acme.bob").unwrap(),
None,
"the stranger became acme's employee"
);
}
// ── passkeys ────────────────────────────────────────────────────────────────
struct Authenticator {
key: p256::ecdsa::SigningKey,
id: Vec<u8>,
}
impl Authenticator {
fn new(seed: u8, id: &[u8]) -> Authenticator {
Authenticator {
key: p256::ecdsa::SigningKey::from_slice(&[seed; 32]).unwrap(),
id: id.to_vec(),
}
}
fn public(&self) -> Vec<u8> {
self.key
.verifying_key()
.to_sec1_point(false)
.as_bytes()
.to_vec()
}
fn client_data(kind: &str, challenge: &[u8]) -> Vec<u8> {
format!(
r#"{{"type":"{kind}","challenge":"{}","origin":"{ORIGIN}","crossOrigin":false}}"#,
gunnar_grpc::webauthn::b64url(challenge)
)
.into_bytes()
}
fn auth_data(counter: u32) -> Vec<u8> {
let mut d = sha2::Sha256::digest(RP_ID.as_bytes()).to_vec();
d.push(0x05);
d.extend_from_slice(&counter.to_be_bytes());
d
}
/// (client data, authenticator data, DER signature) for a get ceremony.
fn assert(&self, challenge: &[u8], counter: u32) -> (Vec<u8>, Vec<u8>, Vec<u8>) {
let cd = Self::client_data("webauthn.get", challenge);
let ad = Self::auth_data(counter);
let mut msg = ad.clone();
msg.extend_from_slice(&sha2::Sha256::digest(&cd));
let sig: p256::ecdsa::Signature = self.key.sign(&msg);
(cd, ad, sig.to_der().as_bytes().to_vec())
}
}
impl Harness {
/// The identity core's sessions on this box.
fn sessions(&self) -> usize {
self.identity.host().gunnar_store().tables().sessions.len()
}
/// The caller the real gate makes of a core session, or its refusal.
fn gate_session(&self, token: &str) -> Result<Caller, tonic::Status> {
let mut request = Request::new(());
request
.metadata_mut()
.insert(SESSION_METADATA_KEY, token.parse().expect("ascii"));
AuthGate::new(Arc::clone(&self.ctx.control), self.ctx.config.auth)
.with_identity(Some(Arc::clone(&self.identity)))
.authenticate_request(&request, now_ms())
.map_err(|failure| failure.status())
}
/// A passkey login through the identity core, as the console relays it.
fn core_login(
&self,
by: &Authenticator,
counter: u32,
) -> Result<nornir_identity::LoggedIn, nornir_identity::Refused> {
let c = self.identity.login_start(&relay())?;
let challenge = gunnar_grpc::webauthn::from_b64url(&c.challenge).expect("b64url");
let (cd, ad, sig) = by.assert(&challenge, counter);
self.identity.login_finish(nornir_identity::Assertion {
ceremony_id: c.id,
credential_id: by.id.clone(),
client_data_json: cd,
authenticator_data: ad,
signature: sig,
rp_id: RP_ID.into(),
origin: ORIGIN.into(),
})
}
/// **A passkey login, and what it may then do**: the core's login, then the
/// session at the real gate — the principal it acts as, or the gate's
/// refusal (`require_sso`: a passkey alone is no credential).
fn passkey_login(&self, by: &Authenticator, counter: u32) -> Result<String, tonic::Status> {
let login = self
.core_login(by, counter)
.map_err(nornir_identity::grpc::status)?;
self.gate_session(&login.token).map(|c| c.principal_id)
}
/// Redeem the core's first-passkey `link` with `by`, as the console relays
/// it: the session the core minted.
fn redeem(
&self,
link: &str,
by: &Authenticator,
attestation_object: Vec<u8>,
public_key: Vec<u8>,
) -> Result<nornir_identity::LoggedIn, nornir_identity::Refused> {
let c = self.identity.redeem_start(link, "", &relay())?;
let challenge = gunnar_grpc::webauthn::from_b64url(&c.challenge).expect("b64url");
self.identity.redeem_finish(nornir_identity::Registration {
ceremony_id: c.id,
credential_id: by.id.clone(),
public_key,
client_data_json: Authenticator::client_data("webauthn.create", &challenge),
attestation_object,
rp_id: RP_ID.into(),
origin: ORIGIN.into(),
})
}
async fn second_factor(
&self,
pending: &str,
session: &str,
) -> Result<SecondFactorResponse, tonic::Status> {
self.sso()
.second_factor(authed(
&self.console,
SecondFactorRequest {
pending: pending.into(),
session: session.into(),
},
))
.await
.map(|r| r.into_inner())
}
}
/// ★ **`require_sso`**: an employee's passkey alone is refused — they sign in
/// through the company — while the account admin's passkey still logs them
/// in (the break-glass: the admin is not an employee).
#[tokio::test(flavor = "multi_thread")]
async fn require_sso_blocks_an_employees_passkey_but_not_the_admins() {
let h = Harness::new();
h.configure(h.oidc_provider("acme", true, false)).await;
let (answer, _) = h.oidc_login("acme", bob()).await;
let employee = answer.unwrap().principal.unwrap().id;
let bobs_key = Authenticator::new(3, b"bob-yubikey");
h.plane
.add_credential(&employee, &bobs_key.id, &bobs_key.public(), "bob's key", 0)
.unwrap();
let admins_key = Authenticator::new(4, b"acme-yubikey");
h.plane
.add_credential(
"acme",
&admins_key.id,
&admins_key.public(),
"acme's YubiKey",
0,
)
.unwrap();
let refused = h
.passkey_login(&bobs_key, 1)
.expect_err("bob's passkey alone");
assert_eq!(refused.code(), Code::PermissionDenied);
assert!(
refused.message().contains("Sign in with acme corp"),
"{}",
refused.message()
);
let admin = h
.passkey_login(&admins_key, 1)
.expect("the admin's break-glass");
assert_eq!(admin, "acme");
// Without require_sso the same passkey logs bob in.
h.configure(h.oidc_provider("acme", false, false)).await;
let ok = h.passkey_login(&bobs_key, 2).expect("no longer required");
assert_eq!(ok, employee);
}
/// ★ **`require_passkey`**: after the IdP, a passkey. The first login
/// registers the person's first one; the next asks for an assertion of it;
/// another person's passkey is refused; no session before the passkey.
#[tokio::test(flavor = "multi_thread")]
async fn require_passkey_puts_a_passkey_after_the_idp() {
let h = Harness::new();
h.configure(h.oidc_provider("acme", true, true)).await;
let (first, session) = h.oidc_login("acme", bob()).await;
let first = first.unwrap();
assert_eq!(
first.second_factor,
SecondFactorNeed::PasskeyRegistration as i32
);
assert!(session.is_empty(), "a session before the passkey");
assert!(
!first.enrolment.is_empty(),
"the core's link for the first passkey"
);
assert_eq!(h.sessions(), 0, "a session before the passkey");
let bobs = Authenticator::new(5, b"bob-first-key");
// Stinky row 13 (2026-10-10): the key registered is the one bob's
// authenticator attested, not one the relay swapped in — nor one with no
// attestation at all. (The core's ceremony; the link stays open.)
let relays = Authenticator::new(66, b"bob-first-key");
for (what, attestation_object) in [
(
"the attested key is bob's, the relayed one is not",
gunnar_grpc::webauthn::attestation_none(RP_ID, &bobs.id, &bobs.public(), 0),
),
("no attestation object", Vec::new()),
] {
let refused = h
.redeem(
&first.enrolment,
&relays,
attestation_object,
relays.public(),
)
.expect_err(what);
assert_eq!(
refused.code,
nornir_identity::Code::Ceremony,
"{what}: {refused:?}"
);
assert!(
h.plane.credential(&relays.id).unwrap().is_none(),
"{what}: the relay's key was stored"
);
assert_eq!(h.sessions(), 0, "{what}: a session");
}
let first_session = h
.redeem(
&first.enrolment,
&bobs,
gunnar_grpc::webauthn::attestation_none(RP_ID, &bobs.id, &bobs.public(), 0),
bobs.public(),
)
.expect("the first passkey registers through the core");
assert_eq!(first_session.session.user_id, "acme.bob");
// require_sso: until the IdP's ticket takes it, the passkey's session is no credential.
assert_eq!(
h.gate_session(&first_session.token)
.expect_err("not yet admitted")
.code(),
Code::PermissionDenied
);
let done = h
.second_factor(&first.pending, &first_session.token)
.await
.expect("the first passkey signs in");
assert_eq!(done.principal.map(|p| p.id).as_deref(), Some("acme.bob"));
assert_eq!(
h.gate_session(&first_session.token)
.expect("admitted")
.principal_id,
"acme.bob"
);
// The ticket is spent.
let again = h.second_factor(&first.pending, &first_session.token).await;
assert_eq!(again.unwrap_err().code(), Code::PermissionDenied);
let (next, _) = h.oidc_login("acme", bob()).await;
let next = next.unwrap();
assert_eq!(next.second_factor, SecondFactorNeed::Passkey as i32);
assert_eq!(next.credential_ids, vec![bobs.id.clone()]);
// The account admin's passkey is not bob's.
let admins = Authenticator::new(6, b"acme-key");
h.plane
.add_credential("acme", &admins.id, &admins.public(), "acme", 0)
.unwrap();
let theirs = h.core_login(&admins, 1).expect("the admin logs in");
let wrong = h
.second_factor(&next.pending, &theirs.token)
.await
.expect_err("another person's passkey");
assert_eq!(wrong.code(), Code::PermissionDenied);
let (next, _) = h.oidc_login("acme", bob()).await;
let next = next.unwrap();
let bob_again = h.core_login(&bobs, 1).expect("bob's passkey");
h.second_factor(&next.pending, &bob_again.token)
.await
.expect("bob's passkey after the IdP");
assert_eq!(
h.gate_session(&bob_again.token)
.expect("admitted")
.principal_id,
"acme.bob"
);
// A34-24: the passkey's session after the IdP (SecondFactor vouched it) mints bob's own
// credential; the same passkey's session without the IdP does not even reach the verb.
h.add_own_key(
"acme.bob",
&gunnar_grpc::auth::session_fingerprint(&bob_again.token),
)
.await
.expect("an SSH key from the session the IdP admitted");
let alone = h
.core_login(&bobs, 2)
.expect("bob's passkey alone logs in at the core");
assert!(
h.gate_session(&alone.token).is_err(),
"but that session is no credential under require-SSO"
);
}
// ── SAML ────────────────────────────────────────────────────────────────────
async fn saml_harness() -> (Harness, FakeIdp) {
let h = Harness::new();
let idp = FakeIdp::start().unwrap();
let provider = SsoProvider {
account: "acme".into(),
protocol: SsoProtocol::Saml as i32,
display_name: "Acme SAML".into(),
saml: Some(SamlSettings {
idp_metadata_url: idp.metadata_url(),
username_attribute: "email".into(),
..Default::default()
}),
console_origin: ORIGIN.into(),
..Default::default()
};
let view = h.configure(provider).await;
let saml = view.provider.unwrap().saml.unwrap();
assert_eq!(
saml.idp_entity_id,
idp.entity_id(),
"the metadata was read by URL"
);
assert!(
saml.idp_certificates[0].starts_with("SHA256:"),
"an answer shows fingerprints, never the certificate"
);
assert_eq!(view.acs_url, format!("{ORIGIN}/auth/sso/saml/acs"));
assert!(view.sp_metadata_xml.contains("AssertionConsumerService"));
(h, idp)
}
impl Harness {
async fn finish_saml(
&self,
state: &str,
response: &str,
) -> Result<FinishResponse, tonic::Status> {
self.sso()
.finish(authed(
&self.console,
FinishRequest {
state: state.into(),
saml_response: response.into(),
console_origin: ORIGIN.into(),
..Default::default()
},
))
.await
.map(|r| r.into_inner())
}
}
/// ★ **SAML, the happy path**, and each broken response refused: another
/// SP's audience, expired, the attacker's key, unsigned, another IdP — and a
/// replayed response (same assertion, a fresh state) refused.
#[tokio::test(flavor = "multi_thread")]
async fn saml_happy_path_and_every_broken_response_refused() {
let (h, idp) = saml_harness().await;
let begun = h.begin("acme").await;
assert_eq!(begun.protocol, SsoProtocol::Saml as i32);
let posted = idp.respond(&begun.redirect_url).unwrap();
assert_eq!(posted.relay_state, begun.state);
let ok = h
.finish_saml(&posted.relay_state, &posted.saml_response)
.await
.expect("a signed response");
assert!(ok.created);
assert_eq!(ok.principal.unwrap().id, "acme.carol");
// Replay: the same response under a NEW state (InResponseTo differs, and
// the assertion was consumed).
let begun2 = h.begin("acme").await;
let err = h
.finish_saml(&begun2.state, &posted.saml_response)
.await
.expect_err("a replayed response");
assert_eq!(err.code(), Code::PermissionDenied);
for (tweak, words) in [
(fake_idp::Tweak::WrongAudience, "udience"),
(fake_idp::Tweak::Expired, ""),
(fake_idp::Tweak::ForeignKey, ""),
(fake_idp::Tweak::Unsigned, ""),
(fake_idp::Tweak::WrongIssuer, "issued by"),
] {
idp.tweak_next(tweak);
let begun = h.begin("acme").await;
let posted = idp.respond(&begun.redirect_url).unwrap();
let err = h
.finish_saml(&posted.relay_state, &posted.saml_response)
.await
.expect_err(&format!("{tweak:?} accepted"));
assert_eq!(err.code(), Code::PermissionDenied, "{tweak:?}: {err:?}");
assert!(
err.message().contains(words),
"{tweak:?}: {}",
err.message()
);
}
assert_eq!(h.employees("acme"), vec!["acme.carol".to_owned()]);
}
// ── SCIM and the CSV import ─────────────────────────────────────────────────
impl Harness {
async fn scim(
&self,
bearer: &str,
method: &str,
path: &str,
query: &str,
body: serde_json::Value,
) -> (u32, serde_json::Value) {
let answer = self
.sso()
.scim(authed(
&self.console,
ScimRequest {
bearer: bearer.into(),
method: method.into(),
path: path.into(),
query: query.into(),
body: if body.is_null() {
Vec::new()
} else {
serde_json::to_vec(&body).unwrap()
},
base_url: format!("{ORIGIN}/scim/v2"),
..Default::default()
},
))
.await
.expect("relayed")
.into_inner();
let json = if answer.body.is_empty() {
serde_json::Value::Null
} else {
serde_json::from_slice(&answer.body).unwrap()
};
(answer.status, json)
}
}
/// ★ **A SCIM deactivation names whose sessions it ended** (cov-A
/// 2026-10-06, MEASURED on the estate: the deactivated employee's browser kept
/// its console session, and its next page asked gunnar with a key gunnar no
/// longer takes — an ERROR about "the console's own credential" and a 503):
/// the answer carries the principal, so the console signs them out too; an
/// update that ends nothing names nobody.
#[tokio::test(flavor = "multi_thread")]
async fn a_scim_deactivation_names_the_sessions_it_ended() {
let h = Harness::new();
h.configure(h.oidc_provider("acme", false, false)).await;
let bearer = h
.sso()
.create_scim_token(authed(
&person("acme"),
CreateScimTokenRequest {
account: "acme".into(),
label: "Entra".into(),
..Default::default()
},
))
.await
.unwrap()
.into_inner()
.secret;
let raw = |method: &str, path: &str, body: serde_json::Value| ScimRequest {
bearer: bearer.clone(),
method: method.into(),
path: path.into(),
query: String::new(),
body: serde_json::to_vec(&body).unwrap(),
base_url: format!("{ORIGIN}/scim/v2"),
..Default::default()
};
let made = h
.sso()
.scim(authed(&h.console, raw("POST", "/Users", serde_json::json!({
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"], "userName": "carol@acme.example", "active": true,
}))))
.await
.unwrap()
.into_inner();
let id = serde_json::from_slice::<serde_json::Value>(&made.body).unwrap()["id"]
.as_str()
.unwrap()
.to_owned();
assert!(
made.ended_sessions.is_empty(),
"a creation ends nobody's sessions"
);
let off = |active: &str| {
serde_json::json!({
"schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
"Operations": [{"op": "Replace", "path": "active", "value": active}],
})
};
let deactivated = h
.sso()
.scim(authed(
&h.console,
raw("PATCH", &format!("/Users/{id}"), off("False")),
))
.await
.unwrap()
.into_inner();
assert_eq!(deactivated.status, 200);
assert_eq!(
deactivated.ended_sessions,
vec![id.clone()],
"the deactivated employee's sessions are named"
);
let again = h
.sso()
.scim(authed(
&h.console,
raw("PATCH", &format!("/Users/{id}"), off("True")),
))
.await
.unwrap()
.into_inner();
assert!(
again.ended_sessions.is_empty(),
"a reactivation ends nothing"
);
let deleted = h
.sso()
.scim(authed(
&h.console,
raw("DELETE", &format!("/Users/{id}"), serde_json::Value::Null),
))
.await
.unwrap()
.into_inner();
assert_eq!(
deleted.ended_sessions,
vec![id],
"a deletion ends the sessions too"
);
}
/// ★ **SCIM**: a bearer per account (the secret once, never again);
/// create → a NEW employee, unbound; its first SSO login claims it; PATCH
/// active=false (Entra's string form) → its sessions revoked and its push
/// refused, data kept; reactivated; DELETE → gone from the directory, still
/// gated; groups; a wrong bearer is 401.
#[tokio::test(flavor = "multi_thread")]
async fn scim_creates_updates_deactivates_and_deletes_employees() {
let h = Harness::new();
h.configure(h.oidc_provider("acme", false, false)).await;
let made = h
.sso()
.create_scim_token(authed(
&person("acme"),
CreateScimTokenRequest {
account: "acme".into(),
label: "Entra".into(),
..Default::default()
},
))
.await
.unwrap()
.into_inner();
let bearer = made.secret.clone();
let listed = h
.sso()
.list_scim_tokens(authed(
&person("acme"),
ListScimTokensRequest {
account: "acme".into(),
},
))
.await
.unwrap()
.into_inner();
assert!(
!format!("{listed:?}").contains(&bearer),
"a listing shows the bearer"
);
assert!(
h.sso()
.create_scim_token(authed(
&person("globex"),
CreateScimTokenRequest {
account: "acme".into(),
label: String::new(),
..Default::default()
}
))
.await
.is_err(),
"another account's admin made acme a bearer"
);
let (status, _) = h
.scim("gscim_wrong", "GET", "/Users", "", serde_json::Value::Null)
.await;
assert_eq!(status, 401);
let (status, created) = h
.scim(
&bearer,
"POST",
"/Users",
"",
serde_json::json!({
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
"userName": "Bob@Acme.example", "externalId": "entra-1",
"name": {"givenName": "Bob", "familyName": "Example"},
"emails": [{"value": "bob@acme.example", "primary": true}], "active": true,
}),
)
.await;
assert_eq!(status, 201, "{created}");
let id = created["id"].as_str().unwrap().to_owned();
assert_eq!(id, "acme.bob");
assert_eq!(
h.stores.auth().employer_of(&id).unwrap().as_deref(),
Some("acme")
);
let (status, dup) = h
.scim(
&bearer,
"POST",
"/Users",
"",
serde_json::json!({"userName": "bob@acme.example"}),
)
.await;
assert_eq!(
(status, dup["scimType"].as_str()),
(409, Some("uniqueness"))
);
let (_, found) = h
.scim(
&bearer,
"GET",
"/Users",
"filter=userName%20eq%20%22bob%40acme.example%22",
serde_json::Value::Null,
)
.await;
assert_eq!(found["totalResults"], 1, "{found}");
// Its first SSO login claims it: the same principal, not a new one. The
// IdP vouches for bob's address in acme.example (A34-2: a user name alone
// never claims), a domain acme proved (A34-5).
h.prove("acme", "acme.example")
.await
.expect("acme proves its domain");
let mut verified_bob = bob();
verified_bob.email_verified = Some(true);
let (login, _) = h.oidc_login("acme", verified_bob).await;
let login = login.unwrap();
assert!(!login.created);
assert_eq!(login.principal.unwrap().id, id);
let session = login.session.clone();
assert!(
h.gate_session(&session).is_ok(),
"the employee's session acts"
);
let app = h
.stores
.catalog()
.create(gunnar_core::NewRepo::new(
gunnar_core::RepoRef::new("acme", "app").unwrap(),
))
.expect("acme/app");
h.plane
.grant(&id, "acme", "app", GrantLevel::Write)
.unwrap();
assert!(h
.stores
.auth()
.may(&id, &app, gunnar_core::Level::Write)
.unwrap());
let (status, patched) = h
.scim(
&bearer,
"PATCH",
&format!("/Users/{id}"),
"",
serde_json::json!({
"schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
"Operations": [{"op": "Replace", "path": "active", "value": "False"}],
}),
)
.await;
assert_eq!(status, 200, "{patched}");
assert_eq!(patched["active"], false);
assert!(
h.gate_session(&session).is_err(),
"the session survived the deactivation"
);
assert!(
h.identity.session(&session).is_err(),
"the core still holds the session"
);
assert!(
!h.stores
.auth()
.may(&id, &app, gunnar_core::Level::Write)
.unwrap(),
"a deactivated employee can push"
);
assert!(
h.stores.auth().principal(&id).unwrap().is_some(),
"the data (the employee) is kept"
);
let (refused, _) = h.oidc_login("acme", bob()).await;
assert!(refused.unwrap_err().message().contains("deactivated"));
let (status, back) = h
.scim(
&bearer,
"PATCH",
&format!("/Users/{id}"),
"",
serde_json::json!({"Operations": [{"op": "replace", "value": {"active": true}}]}),
)
.await;
assert_eq!((status, back["active"].as_bool()), (200, Some(true)));
assert!(h
.stores
.auth()
.may(&id, &app, gunnar_core::Level::Write)
.unwrap());
let (status, group) = h
.scim(
&bearer,
"POST",
"/Groups",
"",
serde_json::json!({"displayName": "Engineering", "members": [{"value": id}]}),
)
.await;
assert_eq!(status, 201, "{group}");
let gid = group["id"].as_str().unwrap().to_owned();
let (status, _) = h.scim(&bearer, "PATCH", &format!("/Groups/{gid}"), "", serde_json::json!({"Operations": [{"op": "remove", "path": format!("members[value eq \"{id}\"]")}]})).await;
assert_eq!(status, 200);
let (_, g) = h
.scim(
&bearer,
"GET",
&format!("/Groups/{gid}"),
"",
serde_json::Value::Null,
)
.await;
assert_eq!(g["members"].as_array().unwrap().len(), 0, "{g}");
let (status, _) = h
.scim(
&bearer,
"POST",
"/Groups",
"",
serde_json::json!({"displayName": "Ghosts", "members": [{"value": "globex"}]}),
)
.await;
assert_eq!(status, 400, "a member from outside the directory");
let (status, _) = h
.scim(
&bearer,
"DELETE",
&format!("/Users/{id}"),
"",
serde_json::Value::Null,
)
.await;
assert_eq!(status, 204);
let (status, _) = h
.scim(
&bearer,
"GET",
&format!("/Users/{id}"),
"",
serde_json::Value::Null,
)
.await;
assert_eq!(status, 404);
assert!(
h.stores.auth().gate_of(&id).unwrap().is_some(),
"a deleted user is still gated"
);
assert!(h.stores.auth().principal(&id).unwrap().is_some());
h.sso()
.revoke_scim_token(authed(
&person("acme"),
RevokeScimTokenRequest {
account: "acme".into(),
token_id: made.token.unwrap().token_id,
},
))
.await
.unwrap();
let (status, _) = h
.scim(&bearer, "GET", "/Users", "", serde_json::Value::Null)
.await;
assert_eq!(status, 401, "a revoked bearer still works");
let trail = h.audit().join("\n");
assert!(
!trail.contains(&bearer),
"the bearer reached the audit trail"
);
assert!(
trail.contains("Sso.Scim") && trail.contains("deactivated acme.bob"),
"{trail}"
);
}
/// ★ **RA5-39: two imports at one moment are never both told "queued" for one job.**
/// `Sso.ImportUsers` asked the account's status and then enqueued without holding the lock;
/// the queue hands back the live job for the account, so the second admin's file was never
/// applied and never refused. Many rounds of two admins at once: an answer that is not a
/// refusal names its own job.
#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
async fn ra5_39_two_imports_at_once_are_never_one_job() {
let h = Arc::new(Harness::new());
for round in 0..200 {
let barrier = Arc::new(tokio::sync::Barrier::new(2));
let ask = |n: u32| {
let (h, barrier) = (Arc::clone(&h), Arc::clone(&barrier));
tokio::spawn(async move {
let csv = format!(
"user_name,display_name,email,active\nr{round}n{n}@acme.example,R{n},,true\n"
);
barrier.wait().await;
h.sso()
.import_users(authed(
&person("acme"),
ImportUsersRequest {
account: "acme".into(),
csv,
dry_run: true,
},
))
.await
.map(|r| r.into_inner().job_id)
})
};
let (a, b) = (ask(1), ask(2));
let (a, b) = (a.await.unwrap(), b.await.unwrap());
if let (Ok(a), Ok(b)) = (&a, &b) {
assert_ne!(
a, b,
"round {round}: both admins were told their file is queued, as one job"
);
}
// Let the round's job end before the next.
for _ in 0..500 {
match h.ctx.control.sso_import_status("acme").unwrap() {
Some(job) if job.state == "queued" || job.state == "running" => {
tokio::time::sleep(std::time::Duration::from_millis(2)).await
}
_ => break,
}
}
}
}
/// ★ **The CSV import**: NEW employees, an update, a deactivation; a dry run
/// writes nothing; a bad row is named and the rest go in.
#[tokio::test(flavor = "multi_thread")]
async fn the_csv_import_provisions_updates_and_deactivates() {
let h = Harness::new();
let csv = "user_name,display_name,email,active\nann@acme.example,Ann,ann@acme.example,true\nben@acme.example,Ben,,true\n,nobody,,\n";
let dry = h
.import_as(&person("acme"), "acme", csv, true)
.await
.unwrap();
assert_eq!(dry.state, "done", "{dry:?}");
assert_eq!((dry.created, dry.errors.len()), (2, 1), "{dry:?}");
assert!(h.employees("acme").is_empty(), "a dry run wrote");
let done = h
.import_as(&person("acme"), "acme", csv, false)
.await
.unwrap();
assert_eq!(done.created, 2, "{done:?}");
assert_eq!(
h.employees("acme"),
vec!["acme.ann".to_owned(), "acme.ben".to_owned()]
);
let again =
"user_name,display_name,active\nann@acme.example,Ann A.,true\nben@acme.example,Ben,false\n";
let done = h
.import_as(&person("acme"), "acme", again, false)
.await
.unwrap();
assert_eq!((done.updated, done.deactivated), (1, 1), "{done:?}");
// ★ A34-9: the deactivated person is named, so the console signs them
// out as it does for SCIM's deactivation.
assert_eq!(done.ended_sessions, vec!["acme.ben".to_owned()], "{done:?}");
assert!(h.stores.auth().gate_of("acme.ben").unwrap().is_some());
let dir = h
.sso()
.list_directory(authed(
&person("acme"),
ListDirectoryRequest {
account: "acme".into(),
},
))
.await
.unwrap()
.into_inner();
let ann = dir
.users
.iter()
.find(|u| u.principal_id == "acme.ann")
.unwrap();
assert_eq!(
(ann.display_name.as_str(), ann.source.as_str(), ann.bound),
("Ann A.", "csv", false)
);
// Only the account admin imports.
let err = h
.import_as(&person("globex"), "acme", csv, false)
.await
.unwrap_err();
assert_eq!(err.code(), Code::PermissionDenied);
}
/// The provider is the account admin's: another account's admin can neither
/// read nor set it, and an employee cannot either.
#[tokio::test(flavor = "multi_thread")]
async fn only_the_account_admin_configures_its_provider() {
let h = Harness::new();
let err = h
.sso()
.set_provider(authed(
&person("globex"),
SetProviderRequest {
provider: Some(h.oidc_provider("acme", false, false)),
client_secret: SECRET.into(),
clear_client_secret: false,
clear_idp_ca: false,
},
))
.await
.unwrap_err();
assert_eq!(err.code(), Code::PermissionDenied);
h.configure(h.oidc_provider("acme", false, false)).await;
let (answer, _) = h.oidc_login("acme", bob()).await;
let employee = answer.unwrap().principal.unwrap().id;
let err = h
.sso()
.get_provider(authed(
&person(&employee),
GetProviderRequest {
account: "acme".into(),
..Default::default()
},
))
.await
.unwrap_err();
assert_eq!(err.code(), Code::PermissionDenied, "{err:?}");
// An https issuer is required (the loopback test door aside).
h.ctx.sso.set_allow_loopback_http(false);
let mut plain = h.oidc_provider("acme", false, false);
plain.oidc.as_mut().unwrap().issuer = "http://idp.example.test".into();
let err = h
.sso()
.set_provider(authed(
&person("acme"),
SetProviderRequest {
provider: Some(plain),
client_secret: String::new(),
clear_client_secret: false,
clear_idp_ca: false,
},
))
.await
.unwrap_err();
assert_eq!(err.code(), Code::InvalidArgument, "{err:?}");
}
// ── A34-2: a provisioned employee is claimed only on a stable IdP id or a
// verified e-mail ───────────────────────────────────────────────────────
impl Harness {
/// A SCIM bearer for `account` (its admin asks).
async fn scim_bearer(&self, account: &str) -> String {
self.sso()
.create_scim_token(authed(
&person(account),
CreateScimTokenRequest {
account: account.into(),
label: "a34".into(),
..Default::default()
},
))
.await
.expect("a SCIM token")
.into_inner()
.secret
}
/// SCIM provisions `user_name` in acme with `external_id`; its id.
async fn provision(&self, user_name: &str, external_id: &str) -> String {
let bearer = self.scim_bearer("acme").await;
let (status, made) = self
.scim(
&bearer,
"POST",
"/Users",
"",
serde_json::json!({
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
"userName": user_name, "externalId": external_id,
"emails": [{"value": user_name, "primary": true}], "active": true,
}),
)
.await;
assert_eq!(status, 201, "{made}");
made["id"].as_str().unwrap().to_owned()
}
fn bound(&self, id: &str) -> bool {
self.stores
.auth()
.sso_user(id)
.unwrap()
.is_some_and(|u| u.subject.is_some())
}
}
/// ★ A34-2 (OIDC): **an unverified e-mail cannot claim** a SCIM-provisioned
/// employee. The IdP says bob's address but not that it verified it (the
/// fake sends no `email_verified`: self-service sign-up, an edited profile).
/// Refused by name, audited, and nothing is bound or created.
#[tokio::test(flavor = "multi_thread")]
async fn a34_2_oidc_an_unverified_email_cannot_claim_a_provisioned_employee() {
let h = Harness::new();
h.configure(h.oidc_provider("acme", false, false)).await;
let id = h.provision("bob@acme.example", "entra-1").await;
let (answer, _) = h.oidc_login("acme", bob()).await;
let refused = answer.expect_err("an unverified e-mail claimed a provisioned employee");
assert_eq!(refused.code(), Code::PermissionDenied, "{refused:?}");
assert!(
refused.message().contains("verified"),
"refused by name: {}",
refused.message()
);
assert!(!h.bound(&id), "the employee was bound");
assert_eq!(h.employees("acme"), vec![id], "a second employee was made");
assert!(
h.audit()
.iter()
.any(|l| l.contains(" deny ") && l.contains("claim")),
"the refusal is audited by name: {:?}",
h.audit()
);
}
/// ★ A34-2 (OIDC): **a matching `preferred_username` cannot claim**: it is
/// editable at many IdPs and is not a claim key.
#[tokio::test(flavor = "multi_thread")]
async fn a34_2_oidc_a_matching_preferred_username_cannot_claim() {
let h = Harness::new();
h.configure(h.oidc_provider("acme", false, false)).await;
let id = h.provision("carl@acme.example", "entra-2").await;
let mut mallory =
fake_op::Person::new("00u-mallory", "mallory@elsewhere.mock.invalid", "Mallory");
mallory.preferred_username = "carl@acme.example".into();
let (answer, _) = h.oidc_login("acme", mallory).await;
let refused = answer.expect_err("a matching preferred_username claimed carl");
assert_eq!(refused.code(), Code::PermissionDenied, "{refused:?}");
assert!(
refused.message().contains("preferred_username") || refused.message().contains("user name"),
"refused by name: {}",
refused.message()
);
assert!(!h.bound(&id), "carl was bound to mallory");
}
/// ★ A34-2 (OIDC): **a stable-id binding can claim**: the SCIM `externalId`
/// is the IdP's `sub`, so bob's sign-in binds the provisioned employee.
#[tokio::test(flavor = "multi_thread")]
async fn a34_2_oidc_a_stable_id_binding_claims() {
let h = Harness::new();
h.configure(h.oidc_provider("acme", false, false)).await;
let id = h.provision("bob@acme.example", "00u-bob").await;
let (answer, _) = h.oidc_login("acme", bob()).await;
let done = answer.expect("externalId == sub claims");
assert!(!done.created);
assert_eq!(done.principal.unwrap().id, id);
assert!(h.bound(&id));
}
/// ★ A34-2 (SAML): **an e-mail attribute cannot claim**: SAML carries no
/// verification, so carol's address (the mapped user-name attribute) does
/// not bind a provisioned employee whose externalId is another id.
#[tokio::test(flavor = "multi_thread")]
async fn a34_2_saml_an_email_attribute_cannot_claim_a_provisioned_employee() {
let (h, idp) = saml_harness().await;
let id = h.provision("carol@acme.example", "hr-77").await;
let begun = h.begin("acme").await;
let posted = idp.respond(&begun.redirect_url).unwrap();
let refused = h
.finish_saml(&posted.relay_state, &posted.saml_response)
.await
.expect_err("an e-mail attribute claimed a provisioned employee");
assert_eq!(refused.code(), Code::PermissionDenied, "{refused:?}");
assert!(
refused.message().contains("claim"),
"refused by name: {}",
refused.message()
);
assert!(!h.bound(&id), "carol's employee was bound");
}
/// ★ A34-2 (SAML): **a persistent NameID binding can claim** (SCIM
/// `externalId` == the persistent NameID).
#[tokio::test(flavor = "multi_thread")]
async fn a34_2_saml_a_persistent_name_id_binding_claims() {
let (h, idp) = saml_harness().await;
let id = h
.provision("carol@acme.example", "carol@acme.example")
.await;
let begun = h.begin("acme").await;
let posted = idp.respond(&begun.redirect_url).unwrap();
let done = h
.finish_saml(&posted.relay_state, &posted.saml_response)
.await
.expect("externalId == the persistent NameID claims");
assert!(!done.created);
assert_eq!(done.principal.unwrap().id, id);
assert!(h.bound(&id));
}
/// ★ A34-2 (OIDC): **a verified e-mail in one of the account's e-mail
/// domains claims** the provisioned employee whose address it is, and the
/// binding is audited with how it was made.
#[tokio::test(flavor = "multi_thread")]
async fn a34_2_oidc_a_verified_email_in_a_claimed_domain_claims() {
let h = Harness::new();
h.configure(h.oidc_provider("acme", false, false)).await;
let id = h.provision("bob@acme.example", "hr-12").await;
let mut verified = bob();
verified.email_verified = Some(true);
// A typed domain proves nothing (A34-5): the claim waits for its DNS proof.
let (answer, _) = h.oidc_login("acme", verified.clone()).await;
let refused = answer.expect_err("an unproven domain claimed");
assert!(
refused.message().contains("[sso-claim-domain]"),
"{}",
refused.message()
);
assert!(!h.bound(&id));
h.prove("acme", "acme.example")
.await
.expect("acme proves its domain");
let (answer, _) = h.oidc_login("acme", verified).await;
let done = answer.expect("a verified e-mail in acme.example claims");
assert!(!done.created);
assert_eq!(done.principal.unwrap().id, id);
assert!(h.bound(&id));
assert!(
h.audit().iter().any(|l| l.contains(" allow ")
&& l.contains("claimed=true")
&& l.contains("verified_email")),
"the binding is audited with its basis: {:?}",
h.audit()
);
}
/// ★ A34-2 (OIDC): **a verified e-mail OUTSIDE the account's e-mail domains
/// cannot claim**: the IdP vouches for the address, but the account never
/// said that domain is its own.
#[tokio::test(flavor = "multi_thread")]
async fn a34_2_oidc_a_verified_email_outside_the_claimed_domains_cannot_claim() {
let h = Harness::new();
h.configure(h.oidc_provider("acme", false, false)).await;
let id = h.provision("dan@contractor.mock.invalid", "hr-13").await;
let mut dan = fake_op::Person::new("00u-dan", "dan@contractor.mock.invalid", "Dan");
dan.email_verified = Some(true);
let (answer, _) = h.oidc_login("acme", dan).await;
let refused = answer.expect_err("a verified e-mail outside acme's domains claimed");
assert_eq!(refused.code(), Code::PermissionDenied, "{refused:?}");
assert!(
refused.message().contains("domain"),
"refused by name: {}",
refused.message()
);
assert!(!h.bound(&id), "dan was bound");
}
/// ★ A34-2 (OIDC): **a second IdP identity cannot steal a bound employee**,
/// not even with a verified e-mail in the account's domain: the row is bound
/// to the first subject and is never re-pointed.
#[tokio::test(flavor = "multi_thread")]
async fn a34_2_oidc_a_second_identity_cannot_steal_a_bound_employee() {
let h = Harness::new();
h.configure(h.oidc_provider("acme", false, false)).await;
let id = h.provision("bob@acme.example", "00u-bob").await;
let (first, _) = h.oidc_login("acme", bob()).await;
assert_eq!(
first
.expect("externalId == sub claims")
.principal
.unwrap()
.id,
id
);
let mut thief = fake_op::Person::new("00u-thief", "bob@acme.example", "Not Bob");
thief.email_verified = Some(true);
let (answer, _) = h.oidc_login("acme", thief).await;
let refused = answer.expect_err("a second identity took a bound employee");
assert_eq!(refused.code(), Code::PermissionDenied, "{refused:?}");
assert!(
refused.message().contains("re-pointed"),
"refused by name: {}",
refused.message()
);
let user = h.stores.auth().sso_user(&id).unwrap().unwrap();
assert_eq!(
user.subject,
Some(gunnar_core::sso::subject_key(h.op.issuer(), "00u-bob")),
"the employee is still bob's"
);
}
/// ★ **RA4-2: a refused claim names nobody.** The answer goes to an
/// unauthenticated caller and the reason into the append-only audit chain and
/// the warn log (one `reason`), so none of them may carry the person's e-mail
/// or the employee's id: the refusal's code and a plain sentence only.
#[tokio::test(flavor = "multi_thread")]
async fn ra4_2_a_refused_claim_carries_its_code_and_no_email_or_employee_id() {
let h = Harness::new();
h.configure(h.oidc_provider("acme", false, false)).await;
let check = |refused: tonic::Status, secrets: &[&str], code: &str, seen: usize| {
let msg = refused.message().to_owned();
assert!(
msg.contains(code),
"the answer carries the code {code}: {msg}"
);
let audit = h.audit();
let new: Vec<&String> = audit.iter().skip(seen).collect();
assert!(
new.iter().any(|l| l.contains(code)),
"the audit row carries the code {code}: {new:?}"
);
for s in secrets {
assert!(!msg.contains(s), "the answer names {s}: {msg}");
for l in &new {
assert!(
!l.contains(s),
"the audit row (and the warn log, the same reason) names {s}: {l}"
);
}
}
};
// unverified e-mail
let id = h.provision("bob@acme.example", "hr-1").await;
let seen = h.audit().len();
let (answer, _) = h.oidc_login("acme", bob()).await;
check(
answer.expect_err("refused"),
&["bob@acme.example", &id],
"[sso-claim-unverified]",
seen,
);
// a verified e-mail outside the account's domains
let id = h.provision("dan@contractor.mock.invalid", "hr-2").await;
let mut dan = fake_op::Person::new("00u-dan", "dan@contractor.mock.invalid", "Dan");
dan.email_verified = Some(true);
let seen = h.audit().len();
let (answer, _) = h.oidc_login("acme", dan).await;
check(
answer.expect_err("refused"),
&[
"dan@contractor.mock.invalid",
"contractor.mock.invalid",
&id,
],
"[sso-claim-domain]",
seen,
);
// a bound employee is never re-pointed
h.prove("acme", "acme.example")
.await
.expect("acme proves its domain");
let id = h.provision("eve@acme.example", "00u-eve").await;
let (first, _) = h
.oidc_login(
"acme",
fake_op::Person::new("00u-eve", "eve@acme.example", "Eve"),
)
.await;
first.expect("externalId == sub claims");
let mut thief = fake_op::Person::new("00u-thief", "eve@acme.example", "Not Eve");
thief.email_verified = Some(true);
let seen = h.audit().len();
let (answer, _) = h.oidc_login("acme", thief).await;
check(
answer.expect_err("refused"),
&["eve@acme.example", &id],
"[sso-claim-bound]",
seen,
);
}
/// ★ **A34-10: every SSO write verb needs a fresh, user-verified touch.** A
/// stolen admin session could point the account at a hostile IdP, drop it, or
/// mint a SCIM bearer that never expires. Gunnar refuses SetProvider,
/// RemoveProvider, CreateScimToken and ImportUsers from a session that was not
/// minted by a user-verified passkey login in the last ten minutes, with the
/// code `[stepup]` the console answers with a touch in place.
#[tokio::test(flavor = "multi_thread")]
async fn a34_10_an_sso_write_without_a_fresh_user_verified_touch_is_refused() {
let h = Harness::new();
let stale = Caller {
principal_id: "acme".to_owned(),
fingerprint: "SHA256:a34-10-no-touch".to_owned(),
machine: false,
authenticated: true,
};
let refused = h
.sso()
.set_provider(authed(
&stale,
SetProviderRequest {
provider: Some(h.oidc_provider("acme", false, false)),
client_secret: SECRET.into(),
clear_client_secret: false,
clear_idp_ca: false,
},
))
.await
.expect_err("SetProvider from a session with no fresh touch");
assert_eq!(refused.code(), Code::PermissionDenied, "{refused:?}");
assert!(
refused.message().contains("[stepup]"),
"the console's code: {}",
refused.message()
);
let refused = h
.sso()
.create_scim_token(authed(
&stale,
CreateScimTokenRequest {
account: "acme".into(),
..Default::default()
},
))
.await
.expect_err("CreateScimToken from a session with no fresh touch");
assert!(
refused.message().contains("[stepup]"),
"{}",
refused.message()
);
let refused = h
.sso()
.remove_provider(authed(
&stale,
RemoveProviderRequest {
account: "acme".into(),
},
))
.await
.expect_err("RemoveProvider from a session with no fresh touch");
assert!(
refused.message().contains("[stepup]"),
"{}",
refused.message()
);
// A session that stepped up (a user-verified touch, the core's) may; one
// that did not may not.
let set = |stepped_up: bool| {
let mut request = authed(
&stale,
SetProviderRequest {
provider: Some(h.oidc_provider("acme", false, false)),
client_secret: SECRET.into(),
clear_client_secret: false,
clear_idp_ca: false,
},
);
request.extensions_mut().insert(PersonSession {
stepped_up,
stepped_up_at_unix_ms: None,
});
let sso = h.sso();
async move { sso.set_provider(request).await }
};
set(true)
.await
.expect("a fresh user-verified touch configures the IdP");
let refused = set(false)
.await
.expect_err("a session that did not step up");
assert!(
refused.message().contains("[stepup]"),
"{}",
refused.message()
);
// and it is audited by name
assert!(
h.audit().iter().any(|l| l.contains("[stepup]")),
"{:?}",
h.audit()
);
}
/// ★ **A34-17: the CSV import is a job.** The call answers at once with a
/// job id; the job runs on its own jera lane and the console polls
/// `Sso.ImportStatus`. (That a refused row leaves the whole file unapplied is
/// the identity table's promise: gunnar-core `tests/sso_directory.rs`.) A
/// look-alike user name is refused (A34-43) and the size limit is one, by
/// name (A34-44).
#[tokio::test(flavor = "multi_thread")]
async fn the_csv_import_is_a_job_and_all_or_nothing() {
let h = Harness::new();
let first = h
.sso()
.import_users(authed(
&person("acme"),
ImportUsersRequest {
account: "acme".into(),
csv: "user_name\nann@acme.example\n".into(),
dry_run: false,
},
))
.await
.expect("the import is queued")
.into_inner();
assert!(!first.job_id.is_empty(), "{first:?}");
assert!(
["queued", "running", "done"].contains(&first.state.as_str()),
"{first:?}"
);
// One import per account at a time: wait for this one before the next.
let mut state = first.state.clone();
for _ in 0..500 {
if state == "done" {
break;
}
tokio::time::sleep(std::time::Duration::from_millis(10)).await;
let now = h
.sso()
.import_status(authed(
&person("acme"),
ImportStatusRequest {
account: "acme".into(),
job_id: first.job_id.clone(),
},
))
.await
.expect("the job is still readable")
.into_inner();
assert_eq!(now.job_id, first.job_id);
state = now.state;
}
assert_eq!(state, "done");
assert_eq!(h.employees("acme"), vec!["acme.ann".to_owned()]);
let done = h
.import_as(
&person("acme"),
"acme",
"user_name\nben@acme.example\n",
false,
)
.await
.unwrap();
assert_eq!((done.state.as_str(), done.created), ("done", 1), "{done:?}");
// A look-alike of `ann` (Cyrillic а) is refused by name, never a second person.
let odd = h
.import_as(
&person("acme"),
"acme",
"user_name\n\u{430}nn@acme.example\n",
false,
)
.await
.unwrap();
assert_eq!((odd.created, odd.errors.len()), (0, 1), "{odd:?}");
// The size limit is one, named (A34-44).
let big = format!(
"user_name\n{}",
"x".repeat(gunnar_grpc::sso::directory::CSV_MAX_BYTES)
);
let err = h
.import_as(&person("acme"), "acme", &big, false)
.await
.unwrap_err();
assert!(err.message().contains("[csv_too_large]"), "{err:?}");
let before = h.employees("acme");
assert_eq!(before.len(), 2, "{before:?}");
}
/// ★ **A34-27: a SCIM bearer may be read-only or expire, and refusals are
/// rate limited per client.**
#[tokio::test(flavor = "multi_thread")]
async fn scim_bearers_expire_carry_a_scope_and_refusals_are_limited() {
let h = Harness::new();
let made = h
.sso()
.create_scim_token(authed(
&person("acme"),
CreateScimTokenRequest {
account: "acme".into(),
label: "audit".into(),
expires_in_days: 30,
read_only: true,
},
))
.await
.unwrap()
.into_inner();
let token = made.token.clone().unwrap();
assert!(
token.read_only && token.expires_at_unix_ms > now_ms(),
"{token:?}"
);
let (status, _) = h
.scim(&made.secret, "GET", "/Users", "", serde_json::Value::Null)
.await;
assert_eq!(status, 200);
let (status, _) = h
.scim(
&made.secret,
"POST",
"/Users",
"",
serde_json::json!({ "userName": "eve" }),
)
.await;
assert_eq!(status, 403, "a read-only bearer wrote");
assert!(h.employees("acme").is_empty());
// An expiry past a year is refused by name.
let err = h
.sso()
.create_scim_token(authed(
&person("acme"),
CreateScimTokenRequest {
account: "acme".into(),
label: "x".into(),
expires_in_days: 400,
read_only: false,
},
))
.await
.unwrap_err();
assert_eq!(err.code(), Code::InvalidArgument);
// An expired bearer is a 401 with its own sentence.
let secret = "gscim_expired_for_the_test";
h.stores
.auth()
.create_scim_token(gunnar_core::sso::ScimToken {
id: "old".into(),
account: "acme".into(),
secret_hash: hex::encode(sha2::Sha256::digest(secret.as_bytes())),
label: "old".into(),
created: 1,
created_by: "acme".into(),
last_used: None,
expires: Some(2),
read_only: false,
})
.unwrap();
let (status, body) = h
.scim(secret, "GET", "/Users", "", serde_json::Value::Null)
.await;
assert_eq!(status, 401);
assert!(
body["detail"]
.as_str()
.unwrap_or_default()
.contains("expired"),
"{body}"
);
// A flood of unknown bearers from one client: a few audit rows, then 429.
let before = h
.audit()
.iter()
.filter(|l| l.contains("198.51.100.7"))
.count();
let mut last = 0;
for _ in 0..40 {
let answer = h
.sso()
.scim(authed(
&h.console,
ScimRequest {
bearer: "gscim_nope".into(),
method: "GET".into(),
path: "/Users".into(),
base_url: format!("{ORIGIN}/scim/v2"),
client: "198.51.100.7:4711".into(),
..Default::default()
},
))
.await
.unwrap()
.into_inner();
last = answer.status;
}
assert_eq!(last, 429, "a flood of refused bearers is throttled");
let rows = h
.audit()
.iter()
.filter(|l| l.contains("198.51.100.7"))
.count()
- before;
assert!(
rows <= gunnar_grpc::sso::scim::bearer::AUDITED_PER_MINUTE as usize,
"{rows} audit rows"
);
}
/// ★ **A34-47: the addresses the admin registers at the IdP are gunnar's.**
/// With the console's origin, `GetProvider` answers the redirect URI, the SP
/// entity id, the ACS URL, the sign-in link and the SCIM base, provider or
/// not, every path segment percent-encoded; the console builds none. A
/// non-https origin is refused.
#[tokio::test(flavor = "multi_thread")]
async fn the_console_addresses_are_the_servers() {
let h = Harness::new();
let got = h
.sso()
.get_provider(authed(
&person("acme"),
GetProviderRequest {
account: "acme".into(),
console_origin: "https://console.example/".into(),
},
))
.await
.expect("read")
.into_inner();
assert!(got.view.is_none(), "acme has no provider yet");
let a = got.addresses.expect("the addresses, provider or not");
assert_eq!(
a.redirect_uri,
"https://console.example/auth/sso/oidc/callback"
);
assert_eq!(a.acs_url, "https://console.example/auth/sso/saml/acs");
assert_eq!(a.sp_entity_id, "https://console.example/auth/sso/saml/acme");
assert_eq!(a.login_url, "https://console.example/login/sso/acme");
assert_eq!(a.scim_base_url, "https://console.example/scim/v2");
assert_eq!(
gunnar_grpc::sso::oidc::gunnar_core_paths::segment("a b/c"),
"a%20b%2Fc"
);
let none = h
.sso()
.get_provider(authed(
&person("acme"),
GetProviderRequest {
account: "acme".into(),
..Default::default()
},
))
.await
.expect("read")
.into_inner();
assert!(none.addresses.is_none());
h.ctx.sso.set_allow_loopback_http(false);
let err = h
.sso()
.get_provider(authed(
&person("acme"),
GetProviderRequest {
account: "acme".into(),
console_origin: "http://console.example".into(),
},
))
.await
.unwrap_err();
assert_eq!(err.code(), Code::InvalidArgument);
}
// ── A34-22 / A34-48: re-saving a provider keeps what the page does not resend ──
impl Harness {
async fn resave(&self, provider: SsoProvider) -> Result<ProviderView, tonic::Status> {
let account = provider.account.clone();
self.sso()
.set_provider(authed(
&person(&account),
SetProviderRequest {
provider: Some(provider),
client_secret: String::new(),
clear_client_secret: false,
clear_idp_ca: false,
},
))
.await
.map(|r| r.into_inner().view.expect("a view"))
}
}
/// ★ **A34-22: a SAML provider configured from PASTED metadata is saved again without the XML.**
/// The page resends only the metadata URL (empty here), the user-name attribute and the
/// toggles; gunnar keeps the stored entity id, sign-on URL and certificates, so the admin can
/// turn require-SSO on without pasting the XML again.
#[tokio::test(flavor = "multi_thread")]
async fn a34_22_a_pasted_saml_provider_is_saved_again_without_its_metadata() {
let h = Harness::new();
let idp = FakeIdp::start().unwrap();
let first = h
.configure(SsoProvider {
account: "acme".into(),
protocol: SsoProtocol::Saml as i32,
display_name: "Acme SAML".into(),
saml: Some(SamlSettings {
idp_metadata_xml: idp.metadata_xml(),
username_attribute: "email".into(),
..Default::default()
}),
console_origin: ORIGIN.into(),
..Default::default()
})
.await;
let stored = first.provider.unwrap().saml.unwrap();
assert_eq!(stored.idp_entity_id, idp.entity_id());
let again = h
.resave(SsoProvider {
account: "acme".into(),
protocol: SsoProtocol::Saml as i32,
display_name: "Acme SAML".into(),
saml: Some(SamlSettings {
username_attribute: "email".into(),
..Default::default()
}),
require_sso: true,
console_origin: ORIGIN.into(),
..Default::default()
})
.await
.expect("saved again without the XML");
let p = again.provider.unwrap();
assert!(p.require_sso, "the toggle was saved");
let saml = p.saml.unwrap();
assert_eq!(
saml.idp_entity_id, stored.idp_entity_id,
"the stored entity id is kept"
);
assert_eq!(
saml.idp_sso_url, stored.idp_sso_url,
"the stored sign-on URL is kept"
);
assert_eq!(
saml.idp_certificates, stored.idp_certificates,
"the stored certificates are kept"
);
// Still a working provider: a sign-in goes through.
let begun = h.begin("acme").await;
let posted = idp.respond(&begun.redirect_url).unwrap();
h.finish_saml(&posted.relay_state, &posted.saml_response)
.await
.expect("a signed response after the re-save");
}
/// ★ **A34-48 (gunnar's half): the display-name claim and attribute are kept when not resent.**
/// The page has no field for them and sends them empty; an empty field keeps the stored one.
#[tokio::test(flavor = "multi_thread")]
async fn a34_48_an_unsent_display_name_claim_or_attribute_is_kept() {
let h = Harness::new();
let mut oidc = h.oidc_provider("acme", false, false);
oidc.oidc.as_mut().unwrap().display_name_claim = "nickname".into();
h.configure(oidc).await;
let again = h
.resave(h.oidc_provider("acme", true, false))
.await
.expect("saved again");
assert_eq!(
again.provider.unwrap().oidc.unwrap().display_name_claim,
"nickname",
"the stored claim is kept"
);
let idp = FakeIdp::start().unwrap();
let saml = |attribute: &str| SsoProvider {
account: "globex".into(),
protocol: SsoProtocol::Saml as i32,
display_name: "Globex SAML".into(),
saml: Some(SamlSettings {
idp_metadata_xml: idp.metadata_xml(),
display_name_attribute: attribute.into(),
..Default::default()
}),
console_origin: ORIGIN.into(),
..Default::default()
};
h.configure(saml("displayName")).await;
let again = h.resave(saml("")).await.expect("saved again");
assert_eq!(
again.provider.unwrap().saml.unwrap().display_name_attribute,
"displayName",
"the stored attribute is kept"
);
}
// ── A34-24: require_sso over every credential an employee mints ─────────────
impl Harness {
/// `Access.AddKey` on the employee's own principal, signed by `with` (a key fingerprint).
async fn add_own_key(
&self,
employee: &str,
with: &str,
) -> Result<AddKeyResponse, tonic::Status> {
let (fresh, _) = session();
let caller = Caller {
principal_id: employee.into(),
fingerprint: with.into(),
machine: false,
authenticated: true,
};
gunnar_grpc::AccessService::new(self.ctx.clone())
.add_key(authed(
&caller,
AddKeyRequest {
principal_id: employee.into(),
openssh_public_key: fresh,
comment: "new laptop".into(),
..Default::default()
},
))
.await
.map(|r| r.into_inner())
}
/// `Access.AddCredential` (a passkey) on the employee's own principal, signed by `with`.
async fn add_own_passkey(
&self,
employee: &str,
with: &str,
seed: u8,
) -> Result<AddCredentialResponse, tonic::Status> {
let key = Authenticator::new(seed, &[seed; 16]);
let caller = Caller {
principal_id: employee.into(),
fingerprint: with.into(),
machine: false,
authenticated: true,
};
gunnar_grpc::AccessService::new(self.ctx.clone())
.add_credential(authed(
&caller,
AddCredentialRequest {
principal_id: employee.into(),
credential_id: key.id.clone(),
public_key: key.public(),
label: format!("key {seed}"),
sign_count: 0,
},
))
.await
.map(|r| r.into_inner())
}
}
/// ★ **A34-24: under require-SSO an employee mints a new credential only from a sign-in
/// through the identity provider.** A key that bypasses the IdP (an SSH key that never
/// expires: added before require-SSO, or by the CLI) cannot add another SSH key or a passkey;
/// the session key of an IdP sign-in can. Without require-SSO the old key can again.
#[tokio::test(flavor = "multi_thread")]
async fn a34_24_require_sso_refuses_a_credential_minted_from_a_key_that_bypasses_the_idp() {
let h = Harness::new();
h.configure(h.oidc_provider("acme", true, false)).await;
let (answer, _) = h.oidc_login("acme", bob()).await;
let answer = answer.expect("bob signs in through the IdP");
let employee = answer.principal.unwrap().id;
// The IdP sign-in's identity-core session (Sso.Finish vouched it, A34-24 + IDENTITY-HOST).
assert!(
!answer.session.is_empty(),
"the IdP sign-in minted a core session"
);
let through_the_idp = gunnar_grpc::auth::session_fingerprint(&answer.session);
let (laptop, _) = session();
let old = h
.plane
.add_key(&employee, &laptop, "old laptop", None, &employee, None)
.expect("an SSH key of bob's");
let refused = h
.add_own_key(&employee, &old.fingerprint)
.await
.expect_err("an SSH key from an SSH key");
assert_eq!(refused.code(), Code::PermissionDenied, "{refused:?}");
assert!(
refused.message().contains("Sign in with acme corp"),
"refused by name: {}",
refused.message()
);
let refused = h
.add_own_passkey(&employee, &old.fingerprint, 21)
.await
.expect_err("a passkey from an SSH key");
assert_eq!(refused.code(), Code::PermissionDenied, "{refused:?}");
h.add_own_key(&employee, &through_the_idp)
.await
.expect("an SSH key from the IdP sign-in");
h.add_own_passkey(&employee, &through_the_idp, 22)
.await
.expect("a passkey from the IdP sign-in");
assert!(
h.audit()
.iter()
.any(|l| l.starts_with("Access.AddKey") && l.contains(" deny")),
"the refusal is audited: {:?}",
h.audit()
);
h.configure(h.oidc_provider("acme", false, false)).await;
h.add_own_key(&employee, &old.fingerprint)
.await
.expect("no longer required");
}
/// ★ **A34-24, the identity core's sessions.** A person may call as their core session
/// (fingerprint `session:<hash start>`, IDENTITY-HOST). Under require-SSO an employee's core
/// session mints a new credential only when a sign-in through the IdP admitted it (the
/// persisted admission, RA5-38); a core session from a passkey login bypasses the IdP and is
/// refused by name, as is an admitted one that has ended.
#[tokio::test(flavor = "multi_thread")]
async fn a34_24_require_sso_takes_a_core_session_only_from_an_idp_sign_in() {
let h = Harness::new();
h.configure(h.oidc_provider("acme", true, false)).await;
let (answer, _) = h.oidc_login("acme", bob()).await;
let employee = answer
.expect("bob signs in through the IdP")
.principal
.unwrap()
.id;
let by_passkey = gunnar_grpc::auth::session_fingerprint("nis1.a-passkey-login");
assert!(by_passkey.starts_with("session:"), "{by_passkey}");
let admitted = || {
let s = gunnar_grpc::identity::vouched_session(&h.identity, &employee, false)
.expect("a core session");
h.identity
.host()
.gunnar_store()
.admit_sso_session(&s.token)
.expect("admitted");
s.token
};
let by_the_idp = gunnar_grpc::auth::session_fingerprint(&admitted());
let old = admitted();
h.identity
.logout(&old, false)
.expect("the old sign-in ends");
let ran_out = gunnar_grpc::auth::session_fingerprint(&old);
let refused = h
.add_own_key(&employee, &by_passkey)
.await
.expect_err("an SSH key from a passkey-login core session");
assert_eq!(refused.code(), Code::PermissionDenied, "{refused:?}");
assert!(
refused.message().contains("Sign in with acme corp"),
"refused by name: {}",
refused.message()
);
let refused = h
.add_own_passkey(&employee, &ran_out, 23)
.await
.expect_err("a passkey from an admitted core session that has ended");
assert_eq!(refused.code(), Code::PermissionDenied, "{refused:?}");
h.add_own_key(&employee, &by_the_idp)
.await
.expect("an SSH key from the IdP sign-in's core session");
h.add_own_passkey(&employee, &by_the_idp, 24)
.await
.expect("a passkey from the IdP sign-in's core session");
}
/// ★ **RA5-38: one record of "company sign-on vouched for this core session".** The sign-in's
/// admission is persisted (identity.json, read by the gate under require-SSO), but the vouch the
/// credential mint read lived in memory only: after a restart an employee kept acting (admitted)
/// and was refused minting their own credential (not vouched). Both read the persisted record now.
#[tokio::test(flavor = "multi_thread")]
async fn ra5_38_an_sso_admitted_session_mints_its_own_credential_after_a_restart() {
let h = Harness::new();
h.configure(h.oidc_provider("acme", true, false)).await;
let (answer, token) = h.oidc_login("acme", bob()).await;
let employee = answer
.expect("bob signs in through the IdP")
.principal
.unwrap()
.id;
assert!(!token.is_empty(), "the IdP sign-in's core session");
assert!(h.gate_session(&token).is_ok(), "the admitted session acts");
// The server restarts: a new context over the same control plane and identity core.
let restarted = ServiceContext::new(
Arc::clone(&h.ctx.control),
Arc::new(EventBus::new(16)),
ServerConfig::default(),
)
.with_audit_ledger(h.ledger.clone())
.with_identity(Arc::clone(&h.identity));
let (fresh, _) = session();
let caller = Caller {
principal_id: employee.clone(),
fingerprint: gunnar_grpc::auth::session_fingerprint(&token),
machine: false,
authenticated: true,
};
gunnar_grpc::AccessService::new(restarted)
.add_key(authed(
&caller,
AddKeyRequest {
principal_id: employee,
openssh_public_key: fresh,
comment: "after the restart".into(),
..Default::default()
},
))
.await
.expect("the admitted session mints its own key after a restart");
}
/// The view's proof for `domain`.
fn proof_of<'a>(view: &'a ProviderView, domain: &str) -> &'a DomainProof {
view.domain_proofs
.iter()
.find(|p| p.domain == domain)
.unwrap_or_else(|| panic!("no proof for {domain}: {view:?}"))
}
/// ★ **A34-5 + A34-39: an e-mail domain routes a sign-in only after its DNS
/// proof**, and Discover answers proven domains alone (never an account name).
/// The view names the record to publish; a domain another account merely typed
/// blocks nobody; a public mail domain is refused; once proven, the domain is
/// that account's, and another account cannot prove it too.
#[tokio::test(flavor = "multi_thread")]
async fn a34_5_a_domain_routes_only_after_its_dns_proof() {
let h = Harness::new();
let ask = |hint: &str| {
let req = authed(&h.console, DiscoverRequest { hint: hint.into() });
let sso = h.sso();
async move {
sso.discover(req)
.await
.expect("discover answers")
.into_inner()
}
};
let view = h.configure(h.oidc_provider("acme", false, false)).await;
let proof = proof_of(&view, "acme.example");
assert!(!proof.verified, "{proof:?}");
assert_eq!(proof.txt_name, "_sso-proof.acme.example");
assert_eq!(
proof.txt_value,
gunnar_grpc::sso::domains::proof_value("acme", "acme.example")
);
assert!(
!ask("bob@acme.example").await.found,
"an unproven domain routed a sign-in"
);
assert!(!ask("acme.example").await.found);
assert!(
!ask("acme").await.found,
"an account name is no hint (A34-39)"
);
// globex merely naming acme's domain blocks nobody.
let mut squat = h.oidc_provider("globex", false, false);
squat.domains = vec!["acme.example".into()];
h.configure(squat).await;
// The record is not there: refused by code, and nothing routes.
h.ctx
.sso
.set_dns_resolver(&doh_server(vec!["v=spf1 -all".into()]));
let refused = h
.verify_domain("acme", "acme.example")
.await
.expect_err("no record, no proof");
assert!(
refused.message().contains("[sso-domain-unproven]"),
"{}",
refused.message()
);
// globex's record proves nothing for acme.
h.ctx
.sso
.set_dns_resolver(&doh_server(vec![gunnar_grpc::sso::domains::proof_value(
"globex",
"acme.example",
)]));
assert!(h.verify_domain("acme", "acme.example").await.is_err());
let view = h
.prove("acme", "acme.example")
.await
.expect("the record is there");
assert!(proof_of(&view, "acme.example").verified);
assert!(view
.provider
.as_ref()
.unwrap()
.verified_domains
.contains(&"acme.example".to_owned()));
let found = ask("Bob@ACME.example").await;
assert!(found.found && found.account == "acme", "{found:?}");
assert!(ask("acme.example").await.found);
assert!(
!ask("acme").await.found,
"an account name is still no hint (A34-39)"
);
// The proof is acme's now: globex cannot prove it, even with its own record.
let refused = h
.prove("globex", "acme.example")
.await
.expect_err("a second account proved a taken domain");
assert!(
refused.message().contains("[sso-domain-taken]"),
"{}",
refused.message()
);
assert_eq!(ask("bob@acme.example").await.account, "acme");
// A public mail domain leads to no company.
let mut public = h.oidc_provider("acme", false, false);
public.domains = vec!["gmail.com".into()];
let refused = h
.sso()
.set_provider(authed(
&person("acme"),
SetProviderRequest {
provider: Some(public),
..Default::default()
},
))
.await
.expect_err("gmail.com was taken as a company domain");
assert!(
refused.message().contains("[sso-domain-public]"),
"{}",
refused.message()
);
assert!(
h.audit()
.iter()
.any(|l| l.contains("Sso.VerifyDomain") && l.contains("allow domain=acme.example")),
"the proof is audited: {:?}",
h.audit()
);
}
/// ★ **A34-11: an IdP migration does not lock the directory out.** Bob is bound
/// to the old IdP's subject; the account moves (a new subject for the same
/// person) and his sign-in is refused, never re-pointed; the admin opens a
/// rebind, and bob's next sign-in binds the SAME employee afresh — on the claim
/// rules — while the old subject no longer signs anybody in.
#[tokio::test(flavor = "multi_thread")]
async fn a34_11_a_rebind_lets_the_new_idp_bind_the_same_employee() {
let h = Harness::new();
h.configure(h.oidc_provider("acme", false, false)).await;
h.prove("acme", "acme.example")
.await
.expect("acme proves its domain");
let (first, _) = h.oidc_login("acme", bob()).await;
let bob_id = first.expect("bob's first sign-in").principal.unwrap().id;
let mut migrated = fake_op::Person::new("new-idp-bob", "bob@acme.example", "Bob Example");
migrated.email_verified = Some(true);
let (answer, _) = h.oidc_login("acme", migrated.clone()).await;
let refused = answer.expect_err("a new subject took bob");
assert!(
refused.message().contains("[sso-claim-bound]"),
"{}",
refused.message()
);
let rebound = h
.sso()
.rebind_users(authed(
&person("acme"),
RebindUsersRequest {
account: "acme".into(),
principal_ids: vec![bob_id.clone()],
..Default::default()
},
))
.await
.expect("the account admin opens a rebind")
.into_inner();
assert_eq!(rebound.users.len(), 1);
assert!(
rebound.users[0].rebind && !rebound.users[0].bound,
"{:?}",
rebound.users
);
let (answer, _) = h.oidc_login("acme", migrated).await;
let done = answer.expect("the rebind lets the new IdP bind bob");
assert!(!done.created, "a new employee was made");
assert_eq!(done.principal.unwrap().id, bob_id);
assert_eq!(h.employees("acme"), vec![bob_id.clone()]);
let user = h.stores.auth().sso_user(&bob_id).unwrap().unwrap();
assert_eq!(
user.subject,
Some(gunnar_core::sso::subject_key(h.op.issuer(), "new-idp-bob"))
);
// The old subject signs in nobody now: it would be a new person (JIT), not bob.
let (old, _) = h.oidc_login("acme", bob()).await;
assert_ne!(
old.ok().and_then(|d| d.principal).map(|p| p.id),
Some(bob_id),
"the old subject still signs bob in"
);
assert!(
h.audit()
.iter()
.any(|l| l.contains("Sso.RebindUsers") && l.contains("allow employees=1")),
"the rebind is audited: {:?}",
h.audit()
);
}
/// ★ **A34-25: JIT is the provider's to limit.** `off`: nobody new is made;
/// `domains`: only a verified e-mail in a proven domain.
#[tokio::test(flavor = "multi_thread")]
async fn a34_25_jit_follows_the_providers_policy() {
let h = Harness::new();
let mut off = h.oidc_provider("acme", false, false);
off.jit = SsoJit::Off as i32;
let view = h.configure(off).await;
assert_eq!(view.provider.unwrap().jit, SsoJit::Off as i32);
h.prove("acme", "acme.example")
.await
.expect("acme proves its domain");
let (answer, _) = h.oidc_login("acme", bob()).await;
let refused = answer.expect_err("JIT off made an employee");
assert!(
refused.message().contains("[sso-jit-off]"),
"{}",
refused.message()
);
assert!(h.employees("acme").is_empty());
let mut domains = h.oidc_provider("acme", false, false);
domains.jit = SsoJit::Domains as i32;
h.configure(domains).await;
let (answer, _) = h.oidc_login("acme", bob()).await;
let refused = answer.expect_err("an unverified e-mail was made an employee");
assert!(
refused.message().contains("[sso-jit-domain]"),
"{}",
refused.message()
);
let mut verified = bob();
verified.email_verified = Some(true);
let (answer, _) = h.oidc_login("acme", verified).await;
assert!(
answer
.expect("a verified e-mail in a proven domain")
.created
);
}
/// ★ **A34-46: a refusal carries its code and names nobody.** A deactivated
/// person's sign-in says `[sso-deactivated]`, never their id.
#[tokio::test(flavor = "multi_thread")]
async fn a34_46_a_deactivated_sign_in_is_refused_by_code() {
let h = Harness::new();
h.configure(h.oidc_provider("acme", false, false)).await;
let (first, _) = h.oidc_login("acme", bob()).await;
let id = first.expect("bob's first sign-in").principal.unwrap().id;
h.sso()
.set_user_active(authed(
&person("acme"),
SetUserActiveRequest {
account: "acme".into(),
principal_id: id.clone(),
active: false,
},
))
.await
.expect("the admin deactivates bob");
let (answer, _) = h.oidc_login("acme", bob()).await;
let refused = answer.expect_err("a deactivated person signed in");
assert!(
refused.message().contains("[sso-deactivated]"),
"{}",
refused.message()
);
assert!(
!refused.message().contains(&id),
"the refusal names the employee: {}",
refused.message()
);
}
/// An egress that dials nothing and writes down every URL it was asked for.
#[derive(Default)]
struct Dialled(Mutex<Vec<String>>);
impl gunnar_grpc::sso::Egress for Dialled {
fn get(&self, url: &str) -> Result<(u16, String), String> {
self.0.lock().unwrap().push(url.to_owned());
Err("this test dials nothing".into())
}
fn post_form(&self, url: &str, _: &str, _: &str) -> Result<(u16, String), String> {
self.0.lock().unwrap().push(url.to_owned());
Err("this test dials nothing".into())
}
}
/// ★ **RA5-24: no default public resolver.** With SSO egress on and no
/// `sso_dns_resolver` fed, a domain proof is refused by name
/// (`[sso-domain-resolver]`, "feed sso_dns_resolver") and nothing is dialled:
/// before, the customer's domain and proof name went to https://dns.google.
#[tokio::test(flavor = "multi_thread")]
async fn ra5_24_an_unfed_resolver_refuses_the_domain_proof_and_dials_nobody() {
let h = Harness::new();
h.configure(h.oidc_provider("acme", false, false)).await;
let dialled = Arc::new(Dialled::default());
h.ctx.sso.set_egress(dialled.clone());
h.ctx.sso.set_dns_resolver("");
let refused = h
.verify_domain("acme", "acme.example")
.await
.expect_err("no resolver, no proof");
assert!(
refused.message().contains("[sso-domain-resolver]"),
"{}",
refused.message()
);
assert!(
refused.message().contains("feed sso_dns_resolver"),
"{}",
refused.message()
);
assert_eq!(
*dialled.0.lock().unwrap(),
Vec::<String>::new(),
"a resolver nobody configured was dialled"
);
}