Skip to content

Commit 48186e9

Browse files
pablothedudepablothedude
authored
Merge pull request #43 from OpenConext/feaature/add-test-for-stepup-with-azure-mfa
Add test coverage for SFO GSSP fallback feature
2 parents ca59c1c + 0233d92 commit 48186e9

File tree

6 files changed

+109
-0
lines changed

6 files changed

+109
-0
lines changed

‎stepup/docker-compose.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ services:
1717
- demogssp.dev.openconext.local
1818
- webauthn.dev.openconext.local
1919
- tiqr.dev.openconext.local
20+
- azuremfa.dev.openconext.local
2021
- mailcatcher.dev.openconext.local
2122
hostname: haproxy.docker
2223

‎stepup/middleware/middleware-institution.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
"number_of_tokens_per_identity": 2,
1717
"self_vet": true,
1818
"sso_on_2fa": true,
19+
"sso_registration_bypass": true,
1920
"allow_self_asserted_tokens": true
2021
},
2122
"institution-b.example.com": {

‎stepup/tests/behat/features/bootstrap/SecondFactorAuthContext.php‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,17 @@ public function configureServiceProviderForSecondFactorOnly()
7777
$this->requiredLoa = 2;
7878
}
7979

80+
/**
81+
* @Given a service provider configured for second-factor-only with loa 1.5
82+
*/
83+
public function configureServiceProviderForSecondFactorOnlyLoa1_5()
84+
{
85+
$this->activeIdp = self::SFO_IDP;
86+
$this->activeSp = self::SFO_SP;
87+
$this->requiredLoa = 1.5;
88+
}
89+
90+
8091
/**
8192
* @Given a service provider configured for single-signon
8293
*/
@@ -109,6 +120,23 @@ public function visitServiceProvider()
109120
}
110121
}
111122

123+
/**
124+
* @When I start an SFO authentication for :arg1 with GSSP extension subject :arg2 and institution :arg3
125+
*/
126+
public function startASfoAuthenticationWithGsspExtension(string $userIdentifier, string $subject, string $institution)
127+
{
128+
$this->minkContext->visit($this->spTestUrl);
129+
$this->minkContext->fillField('idp', $this->activeIdp);
130+
$this->minkContext->fillField('sp', $this->activeSp);
131+
$this->minkContext->fillField('loa', $this->requiredLoa);
132+
$this->minkContext->fillField('subject', $userIdentifier);
133+
134+
$this->minkContext->fillField('email_extension', $subject);
135+
$this->minkContext->fillField('sho_extension', $institution);
136+
137+
$this->minkContext->pressButton('Login');
138+
}
139+
112140
/**
113141
* @When I start an SFO authentication for :arg1
114142
*/
@@ -197,6 +225,45 @@ public function verifySpecifiedSecondFactor($tokenType, $smsChallenge = null)
197225
}
198226
}
199227

228+
/**
229+
* @When I verify the azuremfa gssp second factor with email address :arg1
230+
*/
231+
public function authenticateUserInAzureMfaGsspApplication($emailAddress)
232+
{
233+
$this->minkContext->assertPageAddress('https://azuremfa.dev.openconext.local/mock/sso');
234+
235+
// Fill test attributes on demo page
236+
$attributes = sprintf('[
237+
{
238+
"name": "urn:mace:dir:attribute-def:mail",
239+
"value": [
240+
"%s"
241+
]
242+
},
243+
{
244+
"name": "http://schemas.microsoft.com/claims/authnmethodsreferences",
245+
"value": [
246+
"http://schemas.microsoft.com/claims/multipleauthn"
247+
]
248+
}
249+
]', $emailAddress);
250+
251+
$this->minkContext->fillField('attributes', $attributes);
252+
$this->minkContext->pressButton('success');
253+
254+
// Submit assertion
255+
$this->minkContext->assertPageAddress('https://azuremfa.dev.openconext.local/mock/sso');
256+
$this->minkContext->pressButton('Submit assertion');
257+
258+
// Pass through the 'return to sp' redirection page.
259+
$this->minkContext->assertPageAddress('https://azuremfa.dev.openconext.local/saml/sso_return');
260+
$this->minkContext->pressButton('Submit');
261+
262+
// And continue back to the SP via Gateway
263+
$this->minkContext->assertPageAddress('https://gateway.dev.openconext.local/gssp/azuremfa/consume-assertion');
264+
$this->minkContext->pressButton('Submit');
265+
}
266+
200267
/**
201268
* @When I verify the Yubikey second factor
202269
*/
@@ -222,6 +289,9 @@ public function cancelSecondFactorAuthentication($tokenType)
222289
case "demo-gssp":
223290
$this->cancelAuthenticationInDummyGsspApplication();
224291
break;
292+
case "azuremfa-gssp":
293+
$this->cancelAuthenticationInAzureMfaGsspApplication();
294+
break;
225295
default:
226296
throw new Exception(
227297
sprintf(
@@ -315,6 +385,22 @@ public function cancelAuthenticationInDummyGsspApplication()
315385
$this->minkContext->pressButton('Submit');
316386
}
317387

388+
public function cancelAuthenticationInAzureMfaGsspApplication()
389+
{
390+
$this->minkContext->assertPageAddress('https://azuremfa.dev.openconext.local/mock/sso');
391+
// Cancel the dummy authentication action.
392+
$this->minkContext->pressButton('user-cancelled');
393+
394+
// Pass through the gssp
395+
$this->minkContext->pressButton('Submit');
396+
397+
// Pass through the Gateway
398+
$this->minkContext->pressButton('Submit');
399+
400+
// Pass through the SP
401+
$this->minkContext->pressButton('Submit');
402+
}
403+
318404
public function cancelYubikeySsoAuthentication()
319405
{
320406
switch ($this->activeSp) {

‎stepup/tests/behat/features/ra_insitution-configuration.feature‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ Feature: A RAA can view the institution configuration
1010
"verify_email": true,
1111
"self_vet": true,
1212
"sso_on_2fa": true,
13+
"sso_registration_bypass": true,
1314
"allow_self_asserted_tokens": true,
1415
"allowed_second_factors": [],
1516
"number_of_tokens_per_identity": 2
@@ -42,6 +43,7 @@ Feature: A RAA can view the institution configuration
4243
| Show RAA contact information? | Yes |
4344
| E-mail verification enabled? | Yes |
4445
| Single sign on on second factor authentications? | Yes |
46+
| Single sign on registration bypass? | Yes |
4547
| Token activation using an activated token | Allowed |
4648
| Activate a token without the service desk or an activated token | Allowed |
4749
| Allowed second factor tokens | All enabled tokens are available |
@@ -57,6 +59,7 @@ Feature: A RAA can view the institution configuration
5759
| Show RAA contact information? | No |
5860
| E-mail verification enabled? | No |
5961
| Single sign on on second factor authentications? | No |
62+
| Single sign on registration bypass? | No |
6063
| Token activation using an activated token | Not allowed |
6164
| Activate a token without the service desk or an activated token | Not allowed |
6265
| Allowed second factor tokens | sms |

‎stepup/tests/behat/features/sfo_gssp_fallback.feature‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
Feature: A user authenticates with a service provider configured for second-factor-only
2+
In order to login on a service provider
3+
As a user
4+
I must verify the second factor without authenticating with an identity provider
5+
6+
Scenario: A user logs in using SFO using a GSSP token
7+
Given a service provider configured for second-factor-only with loa 1.5
8+
And a user "jane-a1" identified by "urn:collab:person:institution-a.example.com:jane-a1" from institution "institution-a.example.com" with UUID "00000000-0000-4000-8000-000000000001"
9+
When I start an SFO authentication for "urn:collab:person:institution-a.example.com:jane-a1" with GSSP extension subject "jane-a1@institution-a.example.com" and institution "institution-a.example.com"
10+
And I verify the azuremfa gssp second factor with email address "jane-a1@institution-a.example.com"
11+
Then I am logged on the service provider
12+
13+
Scenario: A user cancels SFO authn with a gssp token
14+
Given a service provider configured for second-factor-only with loa 1.5
15+
When I start an SFO authentication for "urn:collab:person:institution-a.example.com:jane-a1" with GSSP extension subject "jane-a1@institution-a.example.com" and institution "institution-a.example.com"
16+
And I cancel the "azuremfa-gssp" second factor authentication
17+
Then I see an error at the service provider

‎stepup/tests/behat/fixtures/middleware-institution.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
"number_of_tokens_per_identity": 2,
1717
"self_vet": true,
1818
"sso_on_2fa": true,
19+
"sso_registration_bypass": true,
1920
"allow_self_asserted_tokens": true
2021
},
2122
"institution-b.example.com": {

0 commit comments

Comments
 (0)