LiveTest, & fix for CCE in SamlSecurityRealm.doFinishLogin #93

jglick · 2021-03-08T22:29:18Z

Trying to provide meaningful test coverage inside this plugin, without relying on ATH. Otherwise tests pass even when the plugin is broken:

diff --git src/main/java/org/jenkinsci/plugins/saml/SamlSecurityRealm.java src/main/java/org/jenkinsci/plugins/saml/SamlSecurityRealm.java
index 056584a..c9c6a72 100644
--- src/main/java/org/jenkinsci/plugins/saml/SamlSecurityRealm.java
+++ src/main/java/org/jenkinsci/plugins/saml/SamlSecurityRealm.java
@@ -250,6 +250,7 @@ public class SamlSecurityRealm extends SecurityRealm {
      */
     public HttpResponse doCommenceLogin(final StaplerRequest request, final StaplerResponse response, @QueryParameter
             String from, @Header("Referer") final String referer) {
+        assert false;
         LOG.fine("SamlSecurityRealm.doCommenceLogin called. Using consumerServiceUrl " + getSamlPluginConfig().getConsumerServiceUrl());
 
         String redirectOnFinish = calculateSafeRedirect(from, referer);
@@ -298,6 +299,7 @@ public class SamlSecurityRealm extends SecurityRealm {
      */
     @RequirePOST
     public HttpResponse doFinishLogin(final StaplerRequest request, final StaplerResponse response) {
+        assert false;
         LOG.finer("SamlSecurityRealm.doFinishLogin called");
         String referer = (String) request.getSession().getAttribute(REFERER_ATTRIBUTE);
         // redirect back to original page

Also fixes a regression: #93 (comment)

jglick · 2021-03-08T22:31:02Z

pom.xml

    <java.level>8</java.level>
-    <jcasc.version>1.35</jcasc.version>
+    <jenkins-test-harness.version>1492.v843c23c9d568</jenkins-test-harness.version> <!-- TODO https://github.com/jenkinsci/jenkins-test-harness/pull/281 -->


jenkinsci/jenkins-test-harness#281

Using RealJenkinsRule here because

saml-plugin/src/main/java/org/jenkinsci/plugins/saml/OpenSAMLWrapper.java

Line 65 in de609d4

thread.setContextClassLoader(InitializationService.class.getClassLoader());

or

saml-plugin/pom.xml

Line 96 in de609d4

<exclusions>

make it less than obvious that plain JenkinsRule would simulate plugin operation as accurately as ATH.

jglick · 2021-03-08T22:40:02Z

The acceptance test started failing as of #90, according to https://ci.jenkins.io/job/Core/job/acceptance-test-harness/job/master/309/testReport/plugins/SAMLPluginTest/java_8_split7___authenticationOK/:

java.lang.ClassCastException: java.lang.String cannot be cast to java.util.List
	at org.jenkinsci.plugins.saml.SamlSecurityRealm.doFinishLogin(SamlSecurityRealm.java:339)

Reproduced that here, and fixed in 2d2cc3b.

…uecomment-618206131

src/test/java/org/jenkinsci/plugins/saml/LiveTest.java

jglick · 2021-03-08T23:05:06Z

src/test/java/org/jenkinsci/plugins/saml/LiveTest.java

+    }
+
+    private static SamlSecurityRealm configureBasicSettings(IdpMetadataConfiguration idpMetadataConfiguration, SamlAdvancedConfiguration advancedConfiguration) throws IOException {
+        // TODO use @DataBoundSetter wherever possible and load defaults from DescriptorImpl


https://www.jenkins.io/doc/developer/plugin-development/pipeline-integration/#constructor-vs-setters

(Would likely also be better for CasC: should be able to omit default values of attributes.)

kuisathaverat · 2021-03-09T08:43:57Z

this is a long-delayed task on my queue, I have an environment to make the manual test (https://github.com/kuisathaverat/jenkins-issues) I'll take a look on the weekend to see what is broken on the ATH

jglick · 2021-03-09T12:51:10Z

I wanted to try comparing the $JENKINS_HOME/config.xml as created by this test to that created by the ATH SAMLPluginTest but I could not get the ATH to even run locally: mvn test … from my host machine got a timeout in

	at org.jenkinsci.test.acceptance.po.PluginManager.checkForUpdates(PluginManager.java:104)
	at org.jenkinsci.test.acceptance.po.PluginManager.installPlugins(PluginManager.java:190)
	at org.jenkinsci.test.acceptance.junit.WithPlugins$RuleImpl$1.installPlugins(WithPlugins.java:195)

and from ath-container.sh it failed to mount files into the fixture.

…es Jetty to silently refuse to serve 302s, maybe due to Stapler-Trace headers or something?

kuisathaverat · 2021-03-10T10:30:18Z

src/main/java/org/jenkinsci/plugins/saml/SamlSecurityRealm.java

-        saveUser |= modifyUserEmail(user, (List<String>) saml2Profile.getAttribute(getEmailAttributeName()));
+        Object _emails = saml2Profile.getAttribute(getEmailAttributeName());
+        @SuppressWarnings("unchecked")
+        List<String> emails = _emails instanceof List ? (List<String>) _emails : _emails instanceof String ? Collections.singletonList((String) _emails) : Collections.emptyList();


Do you see it returning a String? IIRC the SAML definition for the emails is a list, so it always returns a list, even though getAttribute can return a String.

yep, it is a list of strings

<saml:Attribute Name="mail" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"> <saml:AttributeValue xsi:type="xs:string">test@example.com</saml:AttributeValue> </saml:Attribute>

I do not know anything about SAML, I just know that saml2Profile.getAttribute(getEmailAttributeName()) returns a String (an email address), both here and in the acceptance test that started failing as of 2.0.0.

kuisathaverat

LGTM

viceice · 2021-03-12T12:15:25Z

Minimum jenkins version raised to a 2 days old version in a patch release?
Should that be at least a minor release?
Is the minimum jenkins version raise required to fix something?

kuisathaverat · 2021-03-12T12:41:57Z

@viceice the minimum requirement Jenkins core version for the SAMl plugin 2.0.0 is 2.266 that it is a weekly, due there is an LTS version released it is fair to bump the minimum version of the plugin to the new LTS. This PR is included in SAML 2.0.1

For more details about the changes please read the release notes of the plugin and the Jenkins Core

https://github.com/jenkinsci/saml-plugin/releases/tag/saml-2.0.0
https://github.com/jenkinsci/saml-plugin/releases/tag/saml-2.0.1

https://www.jenkins.io/changelog-stable/#v2.277.1
https://www.jenkins.io/changelog/#v2.266

The changes that forced a major release is the change from Spring framework 2.5.x to 5.x

viceice · 2021-03-12T12:44:05Z

Ok, thanks for clarify. Sorry for the noise.

jglick added 2 commits March 8, 2021 16:26

Sketch of LiveTest

88986f8

Got an incremental deployment

88d4834

jglick commented Mar 8, 2021

View reviewed changes

https://github.com/testcontainers/testcontainers-java/issues/2110#iss…

d64e795

…uecomment-618206131

jglick commented Mar 8, 2021

View reviewed changes

src/test/java/org/jenkinsci/plugins/saml/LiveTest.java Outdated Show resolved Hide resolved

jglick commented Mar 8, 2021

View reviewed changes

A bit more debug info printed

de609d4

jglick mentioned this pull request Mar 9, 2021

Reimplement RealJenkinsRule using HTTP endpoints, separating start/run/stop jenkinsci/jenkins-test-harness#281

Merged

JTH bump

da0b9b3

This comment has been minimized.

Sign in to view

jglick added 2 commits March 9, 2021 15:17

Was missing the urn:oasis:names:tc:SAML:2.0:bindings: prefix on binding

42922d3

Updating comment to reflect current stumper

70f82db

This comment has been minimized.

Sign in to view

jglick added 5 commits March 9, 2021 17:04

Apparently including lots of XML in SamlSecurityRealm.toString() caus…

32f4b44

…es Jetty to silently refuse to serve 302s, maybe due to Stapler-Trace headers or something?

Forgot to update current failure

4d4f7e0

Fixed WebClient mistakes; now failing with the same error as ATH!

a0ed057

Need to go back to redirecting after logging in

c0b3811

Fixed a CCE also observed in ATH

2d2cc3b

kuisathaverat reviewed Mar 10, 2021

View reviewed changes

jglick added 4 commits March 10, 2021 13:53

jenkinsci/jenkins-test-harness#281 released

0ad28ba

authenticationOKFromURL

3c14420

authenticationOKPostBinding

099832f

authenticationFail

b44ca8b

jglick changed the title ~~Sketch of LiveTest~~ LiveTest Mar 10, 2021

Formatting tweaks

f78ecf9

jglick marked this pull request as ready for review March 10, 2021 20:11

jglick mentioned this pull request Mar 10, 2021

Removing SAMLPluginTest jenkinsci/acceptance-test-harness#652

Merged

jglick requested a review from kuisathaverat March 10, 2021 20:15

kuisathaverat approved these changes Mar 11, 2021

View reviewed changes

jglick changed the title ~~LiveTest~~ LiveTest, & fix for CCE in SamlSecurityRealm.doFinishLogin Mar 11, 2021

kuisathaverat added the enhancement label Mar 12, 2021

kuisathaverat merged commit c4bd35f into jenkinsci:master Mar 12, 2021

jglick deleted the LiveTest branch March 12, 2021 15:29

jglick mentioned this pull request Mar 12, 2021

[JENKINS-65039] Wants assertions signed by default false #94

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

LiveTest, & fix for CCE in SamlSecurityRealm.doFinishLogin #93

LiveTest, & fix for CCE in SamlSecurityRealm.doFinishLogin #93

jglick commented Mar 8, 2021 •

edited

Loading

jglick Mar 8, 2021

jglick Mar 9, 2021

jglick commented Mar 8, 2021 •

edited

Loading

jglick Mar 8, 2021

jglick Mar 9, 2021

kuisathaverat commented Mar 9, 2021 •

edited

Loading

jglick commented Mar 9, 2021

This comment has been minimized.

This comment has been minimized.

kuisathaverat Mar 10, 2021 •

edited

Loading

kuisathaverat Mar 10, 2021 •

edited

Loading

jglick Mar 10, 2021

kuisathaverat left a comment

viceice commented Mar 12, 2021 •

edited

Loading

kuisathaverat commented Mar 12, 2021 •

edited

Loading

viceice commented Mar 12, 2021

LiveTest, & fix for CCE in SamlSecurityRealm.doFinishLogin #93

LiveTest, & fix for CCE in SamlSecurityRealm.doFinishLogin #93

Conversation

jglick commented Mar 8, 2021 • edited Loading

jglick Mar 8, 2021

Choose a reason for hiding this comment

jglick Mar 9, 2021

Choose a reason for hiding this comment

jglick commented Mar 8, 2021 • edited Loading

jglick Mar 8, 2021

Choose a reason for hiding this comment

jglick Mar 9, 2021

Choose a reason for hiding this comment

kuisathaverat commented Mar 9, 2021 • edited Loading

jglick commented Mar 9, 2021

This comment has been minimized.

This comment has been minimized.

kuisathaverat Mar 10, 2021 • edited Loading

Choose a reason for hiding this comment

kuisathaverat Mar 10, 2021 • edited Loading

Choose a reason for hiding this comment

jglick Mar 10, 2021

Choose a reason for hiding this comment

kuisathaverat left a comment

Choose a reason for hiding this comment

viceice commented Mar 12, 2021 • edited Loading

kuisathaverat commented Mar 12, 2021 • edited Loading

viceice commented Mar 12, 2021

jglick commented Mar 8, 2021 •

edited

Loading

jglick commented Mar 8, 2021 •

edited

Loading

kuisathaverat commented Mar 9, 2021 •

edited

Loading

kuisathaverat Mar 10, 2021 •

edited

Loading

kuisathaverat Mar 10, 2021 •

edited

Loading

viceice commented Mar 12, 2021 •

edited

Loading

kuisathaverat commented Mar 12, 2021 •

edited

Loading