vbatts/quay
Archived
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Merge pull request #2901 from coreos-inc/joseph.schorr/QS-49/oidc-encrypted-pass

Browse source 
Ensure encrypted passwords are not enabled with OIDC auth
This commit is contained in:
josephschorr 2017-11-08 16:20:13 -05:00 committed by GitHub
commit a999f7c1ae
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
util/config/validators/test/test_validate_oidcauth.py
View file

@ -8,6 +8,8 @@ from test.fixtures import *
@pytest.mark.parametrize('unvalidated_config', [ @pytest.mark.parametrize('unvalidated_config', [
({'AUTHENTICATION_TYPE': 'OIDC'}), ({'AUTHENTICATION_TYPE': 'OIDC'}),
({'AUTHENTICATION_TYPE': 'OIDC', 'INTERNAL_OIDC_SERVICE_ID': 'someservice'}), ({'AUTHENTICATION_TYPE': 'OIDC', 'INTERNAL_OIDC_SERVICE_ID': 'someservice'}),
({'AUTHENTICATION_TYPE': 'OIDC', 'INTERNAL_OIDC_SERVICE_ID': 'someservice',
'SOMESERVICE_LOGIN_CONFIG': {}, 'FEATURE_REQUIRE_ENCRYPTED_BASIC_AUTH': True}),
]) ])
def test_validate_invalid_oidc_auth_config(unvalidated_config, app): def test_validate_invalid_oidc_auth_config(unvalidated_config, app):
validator = OIDCAuthValidator() validator = OIDCAuthValidator()

4
util/config/validators/validate_oidcauth.py
View file

@ -10,6 +10,10 @@ class OIDCAuthValidator(BaseValidator):
if config.get('AUTHENTICATION_TYPE', 'Database') != 'OIDC': if config.get('AUTHENTICATION_TYPE', 'Database') != 'OIDC':
return return
# Ensure that encrypted passwords are not required, as they do not work with OIDC auth.
if config.get('FEATURE_REQUIRE_ENCRYPTED_BASIC_AUTH', False):
raise ConfigValidationException('Encrypted passwords must be disabled to use OIDC auth')
login_service_id = config.get('INTERNAL_OIDC_SERVICE_ID') login_service_id = config.get('INTERNAL_OIDC_SERVICE_ID')
if not login_service_id: if not login_service_id:
raise ConfigValidationException('Missing OIDC provider') raise ConfigValidationException('Missing OIDC provider')