Dex

membership/members/tests/test_oidc.py

@@ -6,7 +6,7 @@ from urllib.parse import parse_qs, urlsplit
 from authlib.integrations.django_client import OAuth
 from django.conf import settings
 from django.contrib.sessions.backends.db import SessionStore
-from django.test import RequestFactory, TestCase
+from django.test import RequestFactory, TestCase, override_settings
 from joserfc import jwt
 from joserfc.jwk import RSAKey
 
@@ -71,3 +71,30 @@ class AuthlibFlowTests(TestCase):
         token["id_token"] = jwt.encode({"alg": "RS256", "kid": "test-key"}, claims, other)
         with self.assertRaises(Exception):
             self.exchange(remote, callback, token)
+
+
+class DiscoveryIssuerTests(TestCase):
+    def test_settings_preserve_exact_configured_issuer(self):
+        import importlib
+        import os
+
+        settings_module = importlib.import_module("config.settings")
+        try:
+            with patch.dict(os.environ, {"DEX_ISSUER": "https://dex.example.org/"}):
+                importlib.reload(settings_module)
+                self.assertEqual(settings_module.DEX_ISSUER, "https://dex.example.org/")
+        finally:
+            importlib.reload(settings_module)
+
+    @override_settings(DEX_ISSUER="https://dex.example.org/")
+    @patch("members.views.OAuth")
+    def test_discovery_uses_single_slash_and_exact_issuer(self, oauth):
+        from members.views import dex
+
+        metadata = {"issuer": "https://dex.example.org/", "authorization_endpoint": "https://dex.example.org/auth", "token_endpoint": "https://dex.example.org/token", "jwks_uri": "https://dex.example.org/keys"}
+        oauth.return_value.register.return_value.load_server_metadata.return_value = metadata
+        dex()
+        self.assertEqual(oauth.return_value.register.call_args.kwargs["server_metadata_url"], "https://dex.example.org/.well-known/openid-configuration")
+        metadata["issuer"] = "https://dex.example.org"
+        with self.assertRaisesRegex(ValueError, "issuer mismatch"):
+            dex()

membership/members/views.py

@@ -140,7 +140,7 @@ def finish_registration(request):
 
 def dex():
     oauth = OAuth()
-    remote = oauth.register("dex", client_id=settings.DEX_CLIENT_ID, client_secret=settings.DEX_CLIENT_SECRET, server_metadata_url=settings.DEX_ISSUER + "/.well-known/openid-configuration", client_kwargs={"scope": "openid email profile groups federated:id", "code_challenge_method": "S256", "timeout": 10})
+    remote = oauth.register("dex", client_id=settings.DEX_CLIENT_ID, client_secret=settings.DEX_CLIENT_SECRET, server_metadata_url=settings.DEX_ISSUER.rstrip("/") + "/.well-known/openid-configuration", client_kwargs={"scope": "openid email profile groups federated:id", "code_challenge_method": "S256", "timeout": 10})
     metadata = remote.load_server_metadata()
     if metadata.get("issuer") != settings.DEX_ISSUER:
         raise ValueError("Dex discovery issuer mismatch.")