Skip to content

Commit 6f8dd5e

Browse files
onkarbhatonkarbhat
committed
Add the ability to configure the client id and client secret using environment variables for the OpenShift connector.
Signed-off-by: Onkar Bhat <[email protected]>
1 parent e837475 commit 6f8dd5e

File tree

2 files changed

+150
-11
lines changed

2 files changed

+150
-11
lines changed

‎connector/openshift/openshift.go‎

Lines changed: 44 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import (
99
"io/ioutil"
1010
"net"
1111
"net/http"
12+
"os"
1213
"strings"
1314
"time"
1415

@@ -23,13 +24,15 @@ import (
2324

2425
// Config holds configuration options for OpenShift login
2526
type Config struct {
26-
Issuer string `json:"issuer"`
27-
ClientID string `json:"clientID"`
28-
ClientSecret string `json:"clientSecret"`
29-
RedirectURI string `json:"redirectURI"`
30-
Groups []string `json:"groups"`
31-
InsecureCA bool `json:"insecureCA"`
32-
RootCA string `json:"rootCA"`
27+
Issuer string `json:"issuer"`
28+
ClientID string `json:"clientID"`
29+
ClientIDFromEnv string `json:"clientIDFromEnv"`
30+
ClientSecret string `json:"clientSecret"`
31+
ClientSecretFromEnv string `json:"clientSecretFromEnv"`
32+
RedirectURI string `json:"redirectURI"`
33+
Groups []string `json:"groups"`
34+
InsecureCA bool `json:"insecureCA"`
35+
RootCA string `json:"rootCA"`
3336
}
3437

3538
var (
@@ -66,11 +69,41 @@ func (c *Config) Open(id string, logger log.Logger) (conn connector.Connector, e
6669
wellKnownURL := strings.TrimSuffix(c.Issuer, "/") + "/.well-known/oauth-authorization-server"
6770
req, err := http.NewRequest(http.MethodGet, wellKnownURL, nil)
6871

72+
if c.ClientIDFromEnv == "" && c.ClientID == "" {
73+
return nil, fmt.Errorf("invalid config: clientID or clientIDEnv are required for the OpenShift connector")
74+
}
75+
clientID := c.ClientID
76+
if c.ClientIDFromEnv != "" {
77+
if c.ClientID != "" {
78+
return nil, fmt.Errorf("invalid config: clientID and clientIDEnv are exclusive for the OpenShift connector")
79+
}
80+
var ok bool
81+
clientID, ok = os.LookupEnv(c.ClientIDFromEnv)
82+
if !ok || clientID == "" {
83+
return nil, fmt.Errorf("invalid config: environment variable for the client ID was not set to a valid value")
84+
}
85+
}
86+
87+
if c.ClientSecretFromEnv == "" && c.ClientSecret == "" {
88+
return nil, fmt.Errorf("invalid config: clientSecret or clientSecretEnv are required for the OpenShift connector")
89+
}
90+
clientSecret := c.ClientSecret
91+
if c.ClientSecretFromEnv != "" {
92+
if c.ClientSecret != "" {
93+
return nil, fmt.Errorf("invalid config: clientSecret and clientSecretEnv are exclusive for the OpenShift connector")
94+
}
95+
var ok bool
96+
clientSecret, ok = os.LookupEnv(c.ClientSecretFromEnv)
97+
if !ok || clientSecret == "" {
98+
return nil, fmt.Errorf("invalid config: environment variable for the client secret was not set to a valid value")
99+
}
100+
}
101+
69102
openshiftConnector := openshiftConnector{
70103
apiURL: c.Issuer,
71104
cancel: cancel,
72-
clientID: c.ClientID,
73-
clientSecret: c.ClientSecret,
105+
clientID: clientID,
106+
clientSecret: clientSecret,
74107
insecureCA: c.InsecureCA,
75108
logger: logger,
76109
redirectURI: c.RedirectURI,
@@ -104,8 +137,8 @@ func (c *Config) Open(id string, logger log.Logger) (conn connector.Connector, e
104137
}
105138

106139
openshiftConnector.oauth2Config = &oauth2.Config{
107-
ClientID: c.ClientID,
108-
ClientSecret: c.ClientSecret,
140+
ClientID: clientID,
141+
ClientSecret: clientSecret,
109142
Endpoint: oauth2.Endpoint{
110143
AuthURL: metadata.Auth, TokenURL: metadata.Token,
111144
},

‎connector/openshift/openshift_test.go‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import (
77
"net/http"
88
"net/http/httptest"
99
"net/url"
10+
"os"
1011
"reflect"
1112
"testing"
1213

@@ -52,6 +53,111 @@ func TestOpen(t *testing.T) {
5253
expectEquals(t, oc.oauth2Config.Endpoint.TokenURL, fmt.Sprintf("%s/oauth/token", s.URL))
5354
}
5455

56+
func TestOpenWithEnvsSuccess(t *testing.T) {
57+
s := newTestServer(map[string]interface{}{})
58+
defer s.Close()
59+
60+
hostURL, err := url.Parse(s.URL)
61+
expectNil(t, err)
62+
63+
_, err = http.NewRequest("GET", hostURL.String(), nil)
64+
expectNil(t, err)
65+
66+
os.Setenv("TEST_CLIENT_ID", "testClientId")
67+
os.Setenv("TEST_CLIENT_SECRET", "testClientSecret")
68+
69+
c := Config{
70+
Issuer: s.URL,
71+
ClientIDFromEnv: "TEST_CLIENT_ID",
72+
ClientSecretFromEnv: "TEST_CLIENT_SECRET",
73+
RedirectURI: "https://localhost/callback",
74+
InsecureCA: true,
75+
}
76+
77+
logger := logrus.New()
78+
79+
oconfig, err := c.Open("id", logger)
80+
81+
oc, ok := oconfig.(*openshiftConnector)
82+
83+
expectNil(t, err)
84+
expectEquals(t, ok, true)
85+
expectEquals(t, oc.apiURL, s.URL)
86+
expectEquals(t, oc.clientID, "testClientId")
87+
expectEquals(t, oc.clientSecret, "testClientSecret")
88+
expectEquals(t, oc.redirectURI, "https://localhost/callback")
89+
expectEquals(t, oc.oauth2Config.Endpoint.AuthURL, fmt.Sprintf("%s/oauth/authorize", s.URL))
90+
expectEquals(t, oc.oauth2Config.Endpoint.TokenURL, fmt.Sprintf("%s/oauth/token", s.URL))
91+
}
92+
93+
func TestOpenFailuresForEnvCases(t *testing.T) {
94+
s := newTestServer(map[string]interface{}{})
95+
defer s.Close()
96+
97+
hostURL, err := url.Parse(s.URL)
98+
expectNil(t, err)
99+
100+
_, err = http.NewRequest("GET", hostURL.String(), nil)
101+
expectNil(t, err)
102+
103+
tests := []struct {
104+
clientID string
105+
clientIDFromEnv string
106+
clientSecret string
107+
clientSecretFromEnv string
108+
expectedError error
109+
}{
110+
{
111+
clientID: "",
112+
clientIDFromEnv: "",
113+
clientSecret: "testClientSecret",
114+
clientSecretFromEnv: "",
115+
expectedError: fmt.Errorf("invalid config: clientID or clientIDEnv are required for the OpenShift connector"),
116+
},
117+
{
118+
clientID: "clientID",
119+
clientIDFromEnv: "TEST_CLIENT_ID",
120+
clientSecret: "",
121+
clientSecretFromEnv: "TEST_CLIENT_SECRET",
122+
expectedError: fmt.Errorf("invalid config: clientID and clientIDEnv are exclusive for the OpenShift connector"),
123+
},
124+
{
125+
clientID: "clientID",
126+
clientIDFromEnv: "",
127+
clientSecret: "",
128+
clientSecretFromEnv: "",
129+
expectedError: fmt.Errorf("invalid config: clientSecret or clientSecretEnv are required for the OpenShift connector"),
130+
},
131+
{
132+
clientID: "",
133+
clientIDFromEnv: "TEST_CLIENT_ID",
134+
clientSecret: "clientSecret",
135+
clientSecretFromEnv: "TEST_CLIENT_SECRET",
136+
expectedError: fmt.Errorf("invalid config: clientSecret and clientSecretEnv are exclusive for the OpenShift connector"),
137+
},
138+
}
139+
140+
for _, tc := range tests {
141+
c := Config{
142+
Issuer: s.URL,
143+
ClientID: tc.clientID,
144+
ClientIDFromEnv: tc.clientIDFromEnv,
145+
ClientSecret: tc.clientSecret,
146+
ClientSecretFromEnv: tc.clientSecretFromEnv,
147+
RedirectURI: "https://localhost/callback",
148+
InsecureCA: true,
149+
}
150+
151+
logger := logrus.New()
152+
153+
oconfig, err := c.Open("id", logger)
154+
expectEquals(t, err, tc.expectedError)
155+
156+
_, ok := oconfig.(*openshiftConnector)
157+
expectEquals(t, ok, false)
158+
}
159+
}
160+
55161
func TestGetUser(t *testing.T) {
56162
s := newTestServer(map[string]interface{}{
57163
"/apis/user.openshift.io/v1/users/~": user{

0 commit comments

Comments
 (0)