From: Matthew John Cheetham <mjcheetham@xxxxxxxxxxx>
Add a series of tests to exercise the HTTP authentication header parsing
and the interop with credential helpers. Credential helpers can respond
to requests that contain WWW-Authenticate information with the ability
to select the response Authenticate header scheme.
Signed-off-by: Matthew John Cheetham <mjcheetham@xxxxxxxxxxx>
---
t/helper/test-credential-helper-replay.sh | 14 ++
t/t5556-http-auth.sh | 157 +++++++++++++++++++++-
2 files changed, 170 insertions(+), 1 deletion(-)
create mode 100755 t/helper/test-credential-helper-replay.sh
diff --git a/t/helper/test-credential-helper-replay.sh b/t/helper/test-credential-helper-replay.sh
new file mode 100755
index 00000000000..03e5e63dad6
--- /dev/null
+++ b/t/helper/test-credential-helper-replay.sh
@@ -0,0 +1,14 @@
+cmd=$1
+teefile=$cmd-actual.cred
+catfile=$cmd-response.cred
+rm -f $teefile
+while read line;
+do
+ if test -z "$line"; then
+ break;
+ fi
+ echo "$line" >> $teefile
+done
+if test "$cmd" = "get"; then
+ cat $catfile
+fi
diff --git a/t/t5556-http-auth.sh b/t/t5556-http-auth.sh
index 78da151f122..43f1791a0fe 100755
--- a/t/t5556-http-auth.sh
+++ b/t/t5556-http-auth.sh
@@ -26,6 +26,8 @@ PID_FILE="$(pwd)"/pid-file.pid
SERVER_LOG="$(pwd)"/OUT.server.log
PATH="$GIT_BUILD_DIR/t/helper/:$PATH" && export PATH
+CREDENTIAL_HELPER="$GIT_BUILD_DIR/t/helper/test-credential-helper-replay.sh" \
+ && export CREDENTIAL_HELPER
test_expect_success 'setup repos' '
test_create_repo "$REPO_DIR" &&
@@ -91,7 +93,8 @@ start_http_server () {
per_test_cleanup () {
stop_http_server &&
- rm -f OUT.*
+ rm -f OUT.* &&
+ rm -f *.cred
}
test_expect_success 'http auth anonymous no challenge' '
@@ -102,4 +105,156 @@ test_expect_success 'http auth anonymous no challenge' '
git ls-remote $ORIGIN_URL
'
+test_expect_success 'http auth www-auth headers to credential helper bearer valid' '
+ test_when_finished "per_test_cleanup" &&
+ start_http_server \
+ --auth=bearer:authority=\"id.example.com\"\ q=1\ p=0 \
+ --auth=basic:realm=\"example.com\" \
+ --auth-token=bearer:secret-token &&
+
+ cat >get-expected.cred <<-EOF &&
+ protocol=http
+ host=$HOST_PORT
+ wwwauth[]=bearer authority="id.example.com" q=1 p=0
+ wwwauth[]=basic realm="example.com"
+ EOF
+
+ cat >store-expected.cred <<-EOF &&
+ protocol=http
+ host=$HOST_PORT
+ username=alice
+ password=secret-token
+ authtype=bearer
+ EOF
+
+ cat >get-response.cred <<-EOF &&
+ protocol=http
+ host=$HOST_PORT
+ username=alice
+ password=secret-token
+ authtype=bearer
+ EOF
+
+ git -c credential.helper="$CREDENTIAL_HELPER" ls-remote $ORIGIN_URL &&
+
+ test_cmp get-expected.cred get-actual.cred &&
+ test_cmp store-expected.cred store-actual.cred
+'
+
+test_expect_success 'http auth www-auth headers to credential helper basic valid' '
+ test_when_finished "per_test_cleanup" &&
+ # base64("alice:secret-passwd")
+ USERPASS64=YWxpY2U6c2VjcmV0LXBhc3N3ZA== &&
+ export USERPASS64 &&
+
+ start_http_server \
+ --auth=bearer:authority=\"id.example.com\"\ q=1\ p=0 \
+ --auth=basic:realm=\"example.com\" \
+ --auth-token=basic:$USERPASS64 &&
+
+ cat >get-expected.cred <<-EOF &&
+ protocol=http
+ host=$HOST_PORT
+ wwwauth[]=bearer authority="id.example.com" q=1 p=0
+ wwwauth[]=basic realm="example.com"
+ EOF
+
+ cat >store-expected.cred <<-EOF &&
+ protocol=http
+ host=$HOST_PORT
+ username=alice
+ password=secret-passwd
+ authtype=basic
+ EOF
+
+ cat >get-response.cred <<-EOF &&
+ protocol=http
+ host=$HOST_PORT
+ username=alice
+ password=secret-passwd
+ authtype=basic
+ EOF
+
+ git -c credential.helper="$CREDENTIAL_HELPER" ls-remote $ORIGIN_URL &&
+
+ test_cmp get-expected.cred get-actual.cred &&
+ test_cmp store-expected.cred store-actual.cred
+'
+
+test_expect_success 'http auth www-auth headers to credential helper custom scheme' '
+ test_when_finished "per_test_cleanup" &&
+ start_http_server \
+ --auth=foobar:alg=test\ widget=1 \
+ --auth=bearer:authority=\"id.example.com\"\ q=1\ p=0 \
+ --auth=basic:realm=\"example.com\" \
+ --auth-token=foobar:SECRET-FOOBAR-VALUE &&
+
+ cat >get-expected.cred <<-EOF &&
+ protocol=http
+ host=$HOST_PORT
+ wwwauth[]=foobar alg=test widget=1
+ wwwauth[]=bearer authority="id.example.com" q=1 p=0
+ wwwauth[]=basic realm="example.com"
+ EOF
+
+ cat >store-expected.cred <<-EOF &&
+ protocol=http
+ host=$HOST_PORT
+ username=alice
+ password=SECRET-FOOBAR-VALUE
+ authtype=foobar
+ EOF
+
+ cat >get-response.cred <<-EOF &&
+ protocol=http
+ host=$HOST_PORT
+ username=alice
+ password=SECRET-FOOBAR-VALUE
+ authtype=foobar
+ EOF
+
+ git -c credential.helper="$CREDENTIAL_HELPER" ls-remote $ORIGIN_URL &&
+
+ test_cmp get-expected.cred get-actual.cred &&
+ test_cmp store-expected.cred store-actual.cred
+'
+
+test_expect_success 'http auth www-auth headers to credential helper invalid' '
+ test_when_finished "per_test_cleanup" &&
+ start_http_server \
+ --auth=bearer:authority=\"id.example.com\"\ q=1\ p=0 \
+ --auth=basic:realm=\"example.com\" \
+ --auth-token=bearer:secret-token &&
+
+ cat >get-expected.cred <<-EOF &&
+ protocol=http
+ host=$HOST_PORT
+ wwwauth[]=bearer authority="id.example.com" q=1 p=0
+ wwwauth[]=basic realm="example.com"
+ EOF
+
+ cat >erase-expected.cred <<-EOF &&
+ protocol=http
+ host=$HOST_PORT
+ username=alice
+ password=invalid-token
+ authtype=bearer
+ wwwauth[]=bearer authority="id.example.com" q=1 p=0
+ wwwauth[]=basic realm="example.com"
+ EOF
+
+ cat >get-response.cred <<-EOF &&
+ protocol=http
+ host=$HOST_PORT
+ username=alice
+ password=invalid-token
+ authtype=bearer
+ EOF
+
+ test_must_fail git -c credential.helper="$CREDENTIAL_HELPER" ls-remote $ORIGIN_URL &&
+
+ test_cmp get-expected.cred get-actual.cred &&
+ test_cmp erase-expected.cred erase-actual.cred
+'
+
test_done
--
gitgitgadget
