From 369ea7126527415ebc1333da9f7b5b7d2f6cf8d7 Mon Sep 17 00:00:00 2001 From: Joshua Winters Date: Mon, 25 Nov 2019 15:15:30 -0500 Subject: [PATCH] add cf org:space:role group claim to token Signed-off-by: Joshua Winters Co-authored-by: Rui Yang --- connector/cf/cf.go | 1 + connector/cf/cf_test.go | 32 +++++++++++++++++++------------- 2 files changed, 20 insertions(+), 13 deletions(-) diff --git a/connector/cf/cf.go b/connector/cf/cf.go index 67c3d56702..0dcbb3a86f 100644 --- a/connector/cf/cf.go +++ b/connector/cf/cf.go @@ -291,6 +291,7 @@ func getGroupsClaims(orgs []Org, spaces []Space) []string { for orgName, spaces := range orgSpaces { for _, space := range spaces { groupsClaims[fmt.Sprintf("%s:%s", orgName, space.Name)] = true + groupsClaims[fmt.Sprintf("%s:%s:%s", orgName, space.Name, space.Role)] = true } } diff --git a/connector/cf/cf_test.go b/connector/cf/cf_test.go index f6014230b4..afc273daa1 100644 --- a/connector/cf/cf_test.go +++ b/connector/cf/cf_test.go @@ -48,25 +48,31 @@ func TestHandleCallback(t *testing.T) { identity, err := cfConn.HandleCallback(connector.Scopes{Groups: true}, req) expectEqual(t, err, nil) - expectEqual(t, len(identity.Groups), 18) + expectEqual(t, len(identity.Groups), 24) expectEqual(t, identity.Groups[0], "some-org-guid-1") expectEqual(t, identity.Groups[1], "some-org-guid-2") expectEqual(t, identity.Groups[2], "some-org-guid-3") expectEqual(t, identity.Groups[3], "some-org-guid-4") expectEqual(t, identity.Groups[4], "some-org-name-1") expectEqual(t, identity.Groups[5], "some-org-name-1:some-space-name-1") - expectEqual(t, identity.Groups[6], "some-org-name-2") - expectEqual(t, identity.Groups[7], "some-org-name-2:some-space-name-2") - expectEqual(t, identity.Groups[8], "some-org-name-3") - expectEqual(t, identity.Groups[9], "some-org-name-4") - expectEqual(t, identity.Groups[10], "some-space-guid-1") - expectEqual(t, identity.Groups[11], "some-space-guid-1:auditor") - expectEqual(t, identity.Groups[12], "some-space-guid-1:developer") - expectEqual(t, identity.Groups[13], "some-space-guid-1:manager") - expectEqual(t, identity.Groups[14], "some-space-guid-2") - expectEqual(t, identity.Groups[15], "some-space-guid-2:auditor") - expectEqual(t, identity.Groups[16], "some-space-guid-2:developer") - expectEqual(t, identity.Groups[17], "some-space-guid-2:manager") + expectEqual(t, identity.Groups[6], "some-org-name-1:some-space-name-1:auditor") + expectEqual(t, identity.Groups[7], "some-org-name-1:some-space-name-1:developer") + expectEqual(t, identity.Groups[8], "some-org-name-1:some-space-name-1:manager") + expectEqual(t, identity.Groups[9], "some-org-name-2") + expectEqual(t, identity.Groups[10], "some-org-name-2:some-space-name-2") + expectEqual(t, identity.Groups[11], "some-org-name-2:some-space-name-2:auditor") + expectEqual(t, identity.Groups[12], "some-org-name-2:some-space-name-2:developer") + expectEqual(t, identity.Groups[13], "some-org-name-2:some-space-name-2:manager") + expectEqual(t, identity.Groups[14], "some-org-name-3") + expectEqual(t, identity.Groups[15], "some-org-name-4") + expectEqual(t, identity.Groups[16], "some-space-guid-1") + expectEqual(t, identity.Groups[17], "some-space-guid-1:auditor") + expectEqual(t, identity.Groups[18], "some-space-guid-1:developer") + expectEqual(t, identity.Groups[19], "some-space-guid-1:manager") + expectEqual(t, identity.Groups[20], "some-space-guid-2") + expectEqual(t, identity.Groups[21], "some-space-guid-2:auditor") + expectEqual(t, identity.Groups[22], "some-space-guid-2:developer") + expectEqual(t, identity.Groups[23], "some-space-guid-2:manager") }) t.Run("CallbackWithoutGroupsScope", func(t *testing.T) {