buzzfeed / sso

sso, aka S.S.Octopus, aka octoboi, is a single sign-on solution for securing internal services
MIT License
3.07k stars 187 forks source link

sso_*: allow simultaneous use of Validators #253

Closed Jusshersmith closed 4 years ago

Jusshersmith commented 4 years ago

Problem

The connection between AllowedEmailDomains, AllowedEmailAddresses, and AllowedGroups is unclear. If all specified, they don't work together well which causes awkward workarounds to be put into place.

Solution

Introduce a more structured 'Validator' type within SSO, allowing us to create better and clearer dynamics between these settings (and any other validators that may be added in the future).

There are currently three separate validators:

SSO will now allow the request through providing at least one of these validators pass.

Notes

codecov[bot] commented 4 years ago

Codecov Report

Merging #253 into master will increase coverage by 0.1%. The diff coverage is 62.04%.

@@            Coverage Diff            @@
##           master     #253     +/-   ##
=========================================
+ Coverage   62.04%   62.14%   +0.1%     
=========================================
  Files          50       53      +3     
  Lines        4105     4169     +64     
=========================================
+ Hits         2547     2591     +44     
- Misses       1370     1391     +21     
+ Partials      188      187      -1
Impacted Files Coverage Δ
internal/pkg/options/email_group_validator.go 0% <0%> (ø)
internal/pkg/options/mock_validator.go 0% <0%> (ø)
internal/proxy/proxy.go 20.45% <0%> (-1.5%) :arrow_down:
internal/pkg/options/validators.go 0% <0%> (ø)
internal/pkg/options/email_address_validator.go 100% <100%> (ø) :arrow_up:
internal/auth/options.go 78.57% <100%> (ø) :arrow_up:
internal/auth/authenticator.go 86.18% <100%> (+0.37%) :arrow_up:
internal/pkg/options/email_domain_validator.go 100% <100%> (ø) :arrow_up:
internal/proxy/oauthproxy.go 54.1% <55.55%> (+3.98%) :arrow_up:
internal/auth/mux.go 75% <75%> (ø) :arrow_up:
... and 4 more
Jusshersmith commented 4 years ago

Some additional test files are also needed, i.e: internal/pkg/options/email_group_validator_test.go