github.com/vmware/govmomi@v0.37.2/sts/client_test.go

/*
Copyright (c) 2018-2023 VMware, Inc. All Rights Reserved.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package sts_test

import (
	"context"
	"crypto/tls"
	"encoding/base64"
	"encoding/pem"
	"log"
	"net/url"
	"os"
	"testing"
	"time"

	"github.com/stretchr/testify/require"

	lsim "github.com/vmware/govmomi/lookup/simulator"
	"github.com/vmware/govmomi/session"
	"github.com/vmware/govmomi/simulator"
	"github.com/vmware/govmomi/ssoadmin"
	_ "github.com/vmware/govmomi/ssoadmin/simulator"
	"github.com/vmware/govmomi/ssoadmin/types"
	"github.com/vmware/govmomi/sts"
	_ "github.com/vmware/govmomi/sts/simulator"
	"github.com/vmware/govmomi/vapi/rest"
	"github.com/vmware/govmomi/vim25"
	"github.com/vmware/govmomi/vim25/methods"
	"github.com/vmware/govmomi/vim25/soap"
)

// The following can help debug signature mismatch:
// % vi /usr/lib/vmware-sso/vmware-sts/conf/logging.properties
// # turn up logging for dsig:
// org.jcp.xml.dsig.internal.level = FINE
// com.sun.org.apache.xml.internal.security.level = FINE
// # restart the STS service:
// % service-control --stop vmware-stsd
// % service-control --start vmware-stsd
// % tail -f /var/log/vmware/sso/vmware-rest-idm-http.log

// solutionUserCreate ensures that solution user "govmomi-test" exists for uses with the tests that follow.
func solutionUserCreate(ctx context.Context, info *url.Userinfo, stsClient *sts.Client, vc *vim25.Client) error {
	s, err := stsClient.Issue(ctx, sts.TokenRequest{Userinfo: info})
	if err != nil {
		return err
	}

	admin, err := ssoadmin.NewClient(ctx, vc)
	if err != nil {
		return err
	}

	header := soap.Header{Security: s}
	if err = admin.Login(stsClient.WithHeader(ctx, header)); err != nil {
		return err
	}

	defer func() {
		if err := admin.Logout(ctx); err != nil {
			log.Printf("user logout error: %v", err)
		}
	}()

	id := types.PrincipalId{
		Name:   "govmomi-test",
		Domain: admin.Domain,
	}

	user, err := admin.FindSolutionUser(ctx, id.Name)
	if err != nil {
		return err
	}

	if user == nil {
		block, _ := pem.Decode([]byte(sts.LocalhostCert))
		details := types.AdminSolutionDetails{
			Certificate: base64.StdEncoding.EncodeToString(block.Bytes),
			Description: "govmomi test solution user",
		}

		if err = admin.CreateSolutionUser(ctx, id.Name, details); err != nil {
			return err
		}
	}

	if _, err = admin.GrantWSTrustRole(ctx, id, types.RoleActAsUser); err != nil {
		return err
	}

	_, err = admin.SetRole(ctx, id, types.RoleAdministrator)
	return err
}

func solutionUserCert() *tls.Certificate {
	cert, err := tls.X509KeyPair(sts.LocalhostCert, sts.LocalhostKey)
	if err != nil {
		panic(err)
	}
	return &cert
}

func TestIssueHOK(t *testing.T) {
	ctx := context.Background()
	url := os.Getenv("GOVC_TEST_URL")
	if url == "" {
		t.SkipNow()
	}

	u, err := soap.ParseURL(url)
	if err != nil {
		t.Fatal(err)
	}

	c, err := vim25.NewClient(ctx, soap.NewClient(u, true))
	if err != nil {
		log.Fatal(err)
	}
	_ = c.UseServiceVersion()

	if !c.IsVC() {
		t.SkipNow()
	}

	stsClient, err := sts.NewClient(ctx, c)
	if err != nil {
		t.Fatal(err)
	}

	if err = solutionUserCreate(ctx, u.User, stsClient, c); err != nil {
		t.Fatal(err)
	}

	req := sts.TokenRequest{
		Certificate: solutionUserCert(),
		Delegatable: true,
	}

	s, err := stsClient.Issue(ctx, req)
	if err != nil {
		t.Fatal(err)
	}

	header := soap.Header{Security: s}

	err = session.NewManager(c).LoginByToken(c.WithHeader(ctx, header))
	if err != nil {
		t.Fatal(err)
	}

	now, err := methods.GetCurrentTime(ctx, c)
	if err != nil {
		t.Fatal(err)
	}

	log.Printf("current time=%s", now)

	rc := rest.NewClient(c)
	err = rc.LoginByToken(rc.WithSigner(ctx, s))
	if err != nil {
		t.Fatal(err)
	}
}

func TestIssueTokenByToken(t *testing.T) {
	ctx := context.Background()
	url := os.Getenv("GOVC_TEST_URL")
	if url == "" {
		t.SkipNow()
	}

	u, err := soap.ParseURL(url)
	if err != nil {
		t.Fatal(err)
	}

	vc1, err := vim25.NewClient(ctx, soap.NewClient(u, true))
	if err != nil {
		log.Fatal(err)
	}
	_ = vc1.UseServiceVersion()

	if !vc1.IsVC() {
		t.SkipNow()
	}

	vc2, err := vim25.NewClient(ctx, soap.NewClient(u, true))
	if err != nil {
		log.Fatal(err)
	}
	_ = vc2.UseServiceVersion()

	sts1, err := sts.NewClient(ctx, vc1)
	if err != nil {
		t.Fatal(err)
	}

	if err = solutionUserCreate(ctx, u.User, sts1, vc1); err != nil {
		t.Fatal(err)
	}

	sts2, err := sts.NewClient(ctx, vc2)
	if err != nil {
		t.Fatal(err)
	}

	req1 := sts.TokenRequest{
		Certificate: solutionUserCert(),
		Delegatable: true,
	}

	signer1, err := sts1.Issue(ctx, req1)
	if err != nil {
		t.Fatal(err)
	}

	req2 := signer1.NewRequest()
	// use Assertion header instead of BinarySecurityToken
	req2.Certificate = &tls.Certificate{PrivateKey: req1.Certificate.PrivateKey}

	signer2, err := sts2.Issue(ctx, req2)
	if err != nil {
		t.Fatal(err)
	}

	header := soap.Header{Security: signer2}

	err = session.NewManager(vc2).LoginByToken(vc2.WithHeader(ctx, header))
	if err != nil {
		t.Fatal(err)
	}
}

func TestIssueBearer(t *testing.T) {
	ctx := context.Background()
	url := os.Getenv("GOVC_TEST_URL")
	if url == "" {
		t.SkipNow()
	}

	u, err := soap.ParseURL(url)
	if err != nil {
		t.Fatal(err)
	}

	c, err := vim25.NewClient(ctx, soap.NewClient(u, true))
	if err != nil {
		log.Fatal(err)
	}
	_ = c.UseServiceVersion()

	if !c.IsVC() {
		t.SkipNow()
	}

	stsClient, err := sts.NewClient(ctx, c)
	if err != nil {
		t.Fatal(err)
	}

	// Test that either Certificate or Userinfo is set.
	_, err = stsClient.Issue(ctx, sts.TokenRequest{})
	if err == nil {
		t.Error("expected error")
	}

	req := sts.TokenRequest{
		Userinfo: u.User,
	}

	s, err := stsClient.Issue(ctx, req)
	if err != nil {
		t.Fatal(err)
	}

	header := soap.Header{Security: s}

	err = session.NewManager(c).LoginByToken(c.WithHeader(ctx, header))
	if err != nil {
		t.Fatal(err)
	}

	now, err := methods.GetCurrentTime(ctx, c)
	if err != nil {
		t.Fatal(err)
	}

	log.Printf("current time=%s", now)
}

func TestIssueActAs(t *testing.T) {
	ctx := context.Background()
	url := os.Getenv("GOVC_TEST_URL")
	if url == "" {
		t.SkipNow()
	}

	u, err := soap.ParseURL(url)
	if err != nil {
		t.Fatal(err)
	}

	c, err := vim25.NewClient(ctx, soap.NewClient(u, true))
	if err != nil {
		log.Fatal(err)
	}
	_ = c.UseServiceVersion()

	if !c.IsVC() {
		t.SkipNow()
	}

	stsClient, err := sts.NewClient(ctx, c)
	if err != nil {
		t.Fatal(err)
	}

	if err = solutionUserCreate(ctx, u.User, stsClient, c); err != nil {
		t.Fatal(err)
	}

	req := sts.TokenRequest{
		Delegatable: true,
		Renewable:   true,
		Userinfo:    u.User,
	}

	s, err := stsClient.Issue(ctx, req)
	if err != nil {
		t.Fatal(err)
	}

	req = sts.TokenRequest{
		Lifetime:    24 * time.Hour,
		Token:       s.Token,
		ActAs:       true,
		Delegatable: true,
		Renewable:   true,
		Certificate: solutionUserCert(),
	}

	s, err = stsClient.Issue(ctx, req)
	if err != nil {
		t.Fatal(err)
	}

	header := soap.Header{Security: s}

	err = session.NewManager(c).LoginByToken(c.WithHeader(ctx, header))
	if err != nil {
		t.Fatal(err)
	}

	now, err := methods.GetCurrentTime(ctx, c)
	if err != nil {
		t.Fatal(err)
	}

	t.Logf("current time=%s", now)

	duration := s.Lifetime.Expires.Sub(s.Lifetime.Created)
	if duration < req.Lifetime {
		req.Lifetime = 24 * time.Hour
		req.Token = s.Token
		log.Printf("extending lifetime from %s", s.Lifetime.Expires.Sub(s.Lifetime.Created))
		s, err = stsClient.Renew(ctx, req)
		if err != nil {
			t.Fatal(err)
		}
	} else {
		t.Errorf("duration=%s", duration)
	}

	t.Logf("expires in %s", s.Lifetime.Expires.Sub(s.Lifetime.Created))
}

func TestNewClient(t *testing.T) {
	t.Run("Happy path client creation", func(t *testing.T) {
		simulator.Test(func(ctx context.Context, client *vim25.Client) {
			_, err := sts.NewClient(ctx, client)
			require.NoError(t, err)
		})
	})

	t.Run("STS client should work with Envoy sidecar even when lookup service is down", func(t *testing.T) {
		model := simulator.VPX()

		model.Create()
		simulator.Test(func(ctx context.Context, client *vim25.Client) {
			lsim.BreakLookupServiceURLs()
			// Map Envoy sidecar on the same port as the vcsim client.
			os.Setenv("GOVMOMI_ENVOY_SIDECAR_PORT", client.Client.URL().Port())
			os.Setenv("GOVMOMI_ENVOY_SIDECAR_HOST", client.Client.URL().Hostname())

			c, err := sts.NewClient(ctx, client)
			require.NoError(t, err)

			req := sts.TokenRequest{
				Userinfo: url.UserPassword("foo", "bar"),
			}

			_, err = c.Issue(ctx, req)
			require.NoError(t, err)
		}, model)
	})
}