Moved expires to resource metadata for services.Users.

lib/auth/github.go

@@ -150,7 +150,8 @@ func (s *AuthServer) validateGithubAuthCallback(q url.Values) (*GithubAuthRespon
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	err = s.createGithubUser(connector, *claims)
+	expires := s.clock.Now().UTC().Add(defaults.OAuth2TTL)
+	err = s.createGithubUser(connector, *claims, expires)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -213,7 +214,7 @@ func (s *AuthServer) validateGithubAuthCallback(q url.Values) (*GithubAuthRespon
 	return response, nil
 }
 
-func (s *AuthServer) createGithubUser(connector services.GithubConnector, claims services.GithubClaims) error {
+func (s *AuthServer) createGithubUser(connector services.GithubConnector, claims services.GithubClaims, expires time.Time) error {
 	logins, kubeGroups := connector.MapClaims(claims)
 	if len(logins) == 0 {
 		return trace.BadParameter(
@@ -229,11 +230,11 @@ func (s *AuthServer) createGithubUser(connector services.GithubConnector, claims
 		Metadata: services.Metadata{
 			Name:      claims.Username,
 			Namespace: defaults.Namespace,
+			Expires:   &expires,
 		},
 		Spec: services.UserSpecV2{
-			Roles:   modules.GetModules().RolesFromLogins(logins),
-			Traits:  modules.GetModules().TraitsFromLogins(logins, kubeGroups),
-			Expires: s.clock.Now().UTC().Add(defaults.OAuth2TTL),
+			Roles:  modules.GetModules().RolesFromLogins(logins),
+			Traits: modules.GetModules().TraitsFromLogins(logins, kubeGroups),
 			GithubIdentities: []services.ExternalIdentity{{
 				ConnectorID: connector.GetName(),
 				Username:    claims.Username,

lib/auth/github_test.go

@@ -17,18 +17,56 @@ limitations under the License.
 package auth
 
 import (
+	"context"
+	"fmt"
+	"time"
+
+	authority "github.com/gravitational/teleport/lib/auth/testauthority"
+	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/backend/lite"
 	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/utils"
 
-	check "gopkg.in/check.v1"
+	"github.com/jonboulle/clockwork"
+	"gopkg.in/check.v1"
 )
 
-type GithubSuite struct{}
+type GithubSuite struct {
+	a *AuthServer
+	b backend.Backend
+	c clockwork.FakeClock
+}
 
+var _ = fmt.Printf
 var _ = check.Suite(&GithubSuite{})
 
 func (s *GithubSuite) SetUpSuite(c *check.C) {
+	var err error
+
 	utils.InitLoggerForTests()
+
+	s.c = clockwork.NewFakeClockAt(time.Now())
+
+	s.b, err = lite.NewWithConfig(context.Background(), lite.Config{
+		Path:             c.MkDir(),
+		PollStreamPeriod: 200 * time.Millisecond,
+		Clock:            s.c,
+	})
+	c.Assert(err, check.IsNil)
+
+	clusterName, err := services.NewClusterName(services.ClusterNameSpecV2{
+		ClusterName: "me.localhost",
+	})
+	c.Assert(err, check.IsNil)
+
+	authConfig := &InitConfig{
+		ClusterName:            clusterName,
+		Backend:                s.b,
+		Authority:              authority.New(),
+		SkipPeriodicOperations: true,
+	}
+	s.a, err = NewAuthServer(authConfig)
+	c.Assert(err, check.IsNil)
 }
 
 func (s *GithubSuite) TestPopulateClaims(c *check.C) {
@@ -43,6 +81,41 @@ func (s *GithubSuite) TestPopulateClaims(c *check.C) {
 	})
 }
 
+func (s *GithubSuite) TestCreateGithubUser(c *check.C) {
+	connector := services.NewGithubConnector("github", services.GithubConnectorSpecV3{
+		ClientID:     "fakeClientID",
+		ClientSecret: "fakeClientSecret",
+		RedirectURL:  "https://www.example.com",
+		TeamsToLogins: []services.TeamMapping{
+			services.TeamMapping{
+				Organization: "fakeOrg",
+				Team:         "fakeTeam",
+				Logins:       []string{"foo"},
+			},
+		},
+	})
+
+	claims := services.GithubClaims{
+		Username: "foo",
+		OrganizationToTeams: map[string][]string{
+			"fakeOrg": []string{"fakeTeam"},
+		},
+	}
+
+	// Create GitHub user with 1 minute expiry.
+	err := s.a.createGithubUser(connector, claims, s.c.Now().Add(1*time.Minute))
+	c.Assert(err, check.IsNil)
+
+	// Within that 1 minute period the user should still exist.
+	_, err = s.a.GetUser("foo")
+	c.Assert(err, check.IsNil)
+
+	// Advance time 2 minutes, the user should be gone.
+	s.c.Advance(2 * time.Minute)
+	_, err = s.a.GetUser("foo")
+	c.Assert(err, check.NotNil)
+}
+
 type testGithubAPIClient struct{}
 
 func (c *testGithubAPIClient) getUser() (*userResponse, error) {

lib/auth/helpers.go

@@ -53,6 +53,8 @@ type TestAuthServerConfig struct {
 	AcceptedUsage []string
 	// CipherSuites is the list of ciphers that the server supports.
 	CipherSuites []uint16
+	// Clock is used to control time in tests.
+	Clock clockwork.FakeClock
 }
 
 // CheckAndSetDefaults checks and sets defaults
@@ -63,6 +65,9 @@ func (cfg *TestAuthServerConfig) CheckAndSetDefaults() error {
 	if cfg.Dir == "" {
 		return trace.BadParameter("missing parameter Dir")
 	}
+	if cfg.Clock == nil {
+		cfg.Clock = clockwork.NewFakeClockAt(time.Now())
+	}
 	if len(cfg.CipherSuites) == 0 {
 		cfg.CipherSuites = utils.DefaultCipherSuites()
 	}
@@ -107,7 +112,11 @@ func NewTestAuthServer(cfg TestAuthServerConfig) (*TestAuthServer, error) {
 		TestAuthServerConfig: cfg,
 	}
 	var err error
-	srv.Backend, err = lite.NewWithConfig(context.TODO(), lite.Config{Path: cfg.Dir, PollStreamPeriod: 100 * time.Millisecond})
+	srv.Backend, err = lite.NewWithConfig(context.Background(), lite.Config{
+		Path:             cfg.Dir,
+		PollStreamPeriod: 100 * time.Millisecond,
+		Clock:            cfg.Clock,
+	})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}

lib/auth/oidc.go

@@ -340,11 +340,11 @@ func (a *AuthServer) createOIDCUser(connector services.OIDCConnector, ident *oid
 		Metadata: services.Metadata{
 			Name:      ident.Email,
 			Namespace: defaults.Namespace,
+			Expires:   &ident.ExpiresAt,
 		},
 		Spec: services.UserSpecV2{
-			Roles:   roles,
-			Traits:  traits,
-			Expires: ident.ExpiresAt,
+			Roles:  roles,
+			Traits: traits,
 			OIDCIdentities: []services.ExternalIdentity{
 				{
 					ConnectorID: connector.GetName(),

lib/auth/oidc_test.go

@@ -0,0 +1,110 @@
+/*
+Copyright 2019 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package auth
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	authority "github.com/gravitational/teleport/lib/auth/testauthority"
+	"github.com/gravitational/teleport/lib/backend"
+	"github.com/gravitational/teleport/lib/backend/lite"
+	"github.com/gravitational/teleport/lib/services"
+	"github.com/gravitational/teleport/lib/utils"
+
+	"github.com/coreos/go-oidc/oidc"
+	"github.com/jonboulle/clockwork"
+	"gopkg.in/check.v1"
+)
+
+type OIDCSuite struct {
+	a *AuthServer
+	b backend.Backend
+	c clockwork.FakeClock
+}
+
+var _ = fmt.Printf
+var _ = check.Suite(&OIDCSuite{})
+
+func (s *OIDCSuite) SetUpSuite(c *check.C) {
+	var err error
+
+	utils.InitLoggerForTests()
+
+	s.c = clockwork.NewFakeClockAt(time.Now())
+
+	s.b, err = lite.NewWithConfig(context.Background(), lite.Config{
+		Path:             c.MkDir(),
+		PollStreamPeriod: 200 * time.Millisecond,
+		Clock:            s.c,
+	})
+	c.Assert(err, check.IsNil)
+
+	clusterName, err := services.NewClusterName(services.ClusterNameSpecV2{
+		ClusterName: "me.localhost",
+	})
+	c.Assert(err, check.IsNil)
+
+	authConfig := &InitConfig{
+		ClusterName:            clusterName,
+		Backend:                s.b,
+		Authority:              authority.New(),
+		SkipPeriodicOperations: true,
+	}
+	s.a, err = NewAuthServer(authConfig)
+	c.Assert(err, check.IsNil)
+}
+
+func (s *OIDCSuite) TestCreateOIDCUser(c *check.C) {
+	connector := services.NewOIDCConnector("oidcService", services.OIDCConnectorSpecV2{
+		IssuerURL:    "https://www.example.com",
+		ClientID:     "fakeClientID",
+		ClientSecret: "fakeClientSecret",
+		RedirectURL:  "https://www.example.com/redirect",
+		Scope:        []string{"profile", "email"},
+		ClaimsToRoles: []services.ClaimMapping{
+			services.ClaimMapping{
+				Claim: "email",
+				Value: "foo@example.com",
+				Roles: []string{"admin"},
+			},
+		},
+	})
+
+	ident := &oidc.Identity{
+		Email:     "foo@example.com",
+		ExpiresAt: s.c.Now().Add(1 * time.Minute),
+	}
+
+	claims := map[string]interface{}{
+		"email": "foo@example.com",
+	}
+
+	// Create OIDC user with 1 minute expiry.
+	err := s.a.createOIDCUser(connector, ident, claims)
+	c.Assert(err, check.IsNil)
+
+	// Within that 1 minute period the user should still exist.
+	_, err = s.a.GetUser("foo@example.com")
+	c.Assert(err, check.IsNil)
+
+	// Advance time 2 minutes, the user should be gone.
+	s.c.Advance(2 * time.Minute)
+	_, err = s.a.GetUser("foo@example.com")
+	c.Assert(err, check.NotNil)
+}

lib/auth/password_test.go

@@ -43,8 +43,8 @@ type PasswordSuite struct {
 	a  *AuthServer
 }
 
-var _ = Suite(&PasswordSuite{})
 var _ = fmt.Printf
+var _ = Suite(&PasswordSuite{})
 
 func (s *PasswordSuite) SetUpSuite(c *C) {
 	utils.InitLoggerForTests()

lib/auth/saml.go

@@ -1,3 +1,19 @@
+/*
+Copyright 2019 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
 package auth
 
 import (
@@ -120,11 +136,11 @@ func (a *AuthServer) createSAMLUser(connector services.SAMLConnector, assertionI
 		Metadata: services.Metadata{
 			Name:      assertionInfo.NameID,
 			Namespace: defaults.Namespace,
+			Expires:   &expiresAt,
 		},
 		Spec: services.UserSpecV2{
 			Roles:          roles,
 			Traits:         traits,
-			Expires:        expiresAt,
 			SAMLIdentities: []services.ExternalIdentity{{ConnectorID: connector.GetName(), Username: assertionInfo.NameID}},
 			CreatedBy: services.CreatedBy{
 				User: services.UserRef{Name: "system"},