test(idp): integration and unit tests for adfs, azure, okta

Author: Brooke-white

test/__init__.py

@@ -0,0 +1 @@
+from test.integration import azure_browser_idp, idp_arg, okta_browser_idp, okta_idp

test/integration/__init__.py

@@ -0,0 +1 @@
+from .conftest import azure_browser_idp, idp_arg, okta_browser_idp, okta_idp

test/integration/conftest.py

@@ -103,6 +103,48 @@ def azure_browser_idp():
     return db_connect
 
 
+@pytest.fixture(scope="class")
+def azure_idp():
+    db_connect = {
+        "database": conf.get("database", "database"),
+        "host": conf.get("database", "host"),
+        "port": conf.getint("database", "port"),
+        "db_user": conf.get("database", "user"),
+        "ssl": conf.getboolean("database", "ssl"),
+        "sslmode": conf.get("database", "sslmode"),
+        "password": conf.get("azure-idp", "password"),
+        "iam": conf.getboolean("azure-idp", "iam"),
+        "user": conf.get("azure-idp", "user"),
+        "credentials_provider": conf.get("azure-idp", "credentials_provider"),
+        "region": conf.get("azure-idp", "region"),
+        "cluster_identifier": conf.get("azure-idp", "cluster_identifier"),
+        "idp_tenant": conf.get("azure-idp", "idp_tenant"),
+        "client_id": conf.get("azure-idp", "client_id"),
+        "client_secret": conf.get("azure-idp", "client_secret"),
+    }
+    return db_connect
+
+
+@pytest.fixture(scope="class")
+def adfs_idp():
+    db_connect = {
+        "database": conf.get("database", "database"),
+        "host": conf.get("database", "host"),
+        "port": conf.getint("database", "port"),
+        "db_user": conf.get("database", "user"),
+        "ssl": conf.getboolean("database", "ssl"),
+        "sslmode": conf.get("database", "sslmode"),
+        "password": conf.get("adfs-idp", "password"),
+        "iam": conf.getboolean("adfs-idp", "iam"),
+        "user": conf.get("adfs-idp", "user"),
+        "credentials_provider": conf.get("adfs-idp", "credentials_provider"),
+        "region": conf.get("adfs-idp", "region"),
+        "cluster_identifier": conf.get("adfs-idp", "cluster_identifier"),
+        "idp_host": conf.get("adfs-idp", "idp_host"),
+    }
+    return db_connect
+
+
 @pytest.fixture
 def con(request, db_kwargs):
     conn = redshift_connector.connect(**db_kwargs)
@@ -129,6 +171,11 @@ def fin():
     return cursor
 
 
+@pytest.fixture
+def idp_arg(request):
+    return request.getfixturevalue(request.param)
+
+
 @pytest.fixture
 def is_java():
     return "java" in sys.platform.lower()

test/integration/plugin/test_azure_credentials_provider.py

@@ -0,0 +1,20 @@
+import configparser
+import os
+from test import idp_arg
+
+import pytest  # type: ignore
+
+import redshift_connector
+
+conf = configparser.ConfigParser()
+root_path = os.path.dirname(os.path.dirname(os.path.abspath(os.path.join(__file__, os.pardir))))
+conf.read(root_path + "/config.ini")
+
+PROVIDER = ["azure_idp"]
+
+
+@pytest.mark.parametrize("idp_arg", PROVIDER, indirect=True)
+def test_preferred_role_should_use(idp_arg):
+    idp_arg["preferred_role"] = conf.get("azure-idp", "preferred_role")
+    with redshift_connector.connect(**idp_arg):
+        pass

test/integration/plugin/test_credentials_providers.py

@@ -2,6 +2,7 @@
 import os
 import sys
 import typing
+from test import idp_arg
 
 import botocore
 import pytest  # type: ignore
@@ -14,7 +15,6 @@
 
 
 NON_BROWSER_IDP: typing.List[str] = ["okta_idp"]
-
 ALL_IDP: typing.List[str] = ["okta_browser_idp", "azure_browser_idp"] + NON_BROWSER_IDP
 
 
@@ -46,25 +46,12 @@ def getAcceptedIssuers(self):
     DEFAULT_CONTEXT = SSLContext.getDefault()
 
 
-@pytest.fixture
-def idp_arg(request):
-    return request.getfixturevalue(request.param)
-
-
 @pytest.mark.parametrize("idp_arg", NON_BROWSER_IDP, indirect=True)
 def testIdpPassword(idp_arg):
+    idp_arg = idp_arg
     idp_arg["password"] = "wrong_password"
 
-    with pytest.raises(redshift_connector.InterfaceError, match="Unauthorized"):
-        redshift_connector.connect(**idp_arg)
-
-
-@pytest.mark.parametrize("idp_arg", NON_BROWSER_IDP, indirect=True)
-def testIdpHost(idp_arg):
-    wrong_idp_host = "andrew.okta.com"
-    idp_arg["idp_host"] = wrong_idp_host
-
-    with pytest.raises(redshift_connector.InterfaceError, match="Unauthorized"):
+    with pytest.raises(redshift_connector.InterfaceError, match=r"(Unauthorized)|(400 Client Error: Bad Request)"):
         redshift_connector.connect(**idp_arg)
 
 
@@ -96,12 +83,8 @@ def testCredentialsProvider(idp_arg):
 
 
 @pytest.mark.parametrize("idp_arg", NON_BROWSER_IDP, indirect=True)
-def testPreferredRole(idp_arg):
-    idp_arg["preferred_role"] = conf.get("okta-idp", "preferred_role")
-    with redshift_connector.connect(**idp_arg):
-        pass
-
-    idp_arg["preferred_role"] = "arn:aws:iam::111111111111:role/Okta-role"
+def test_preferred_role_invalid_should_fail(idp_arg):
+    idp_arg["preferred_role"] = "arn:aws:iam::111111111111:role/Trash-role"
     with pytest.raises(redshift_connector.InterfaceError, match="Preferred role not found in SamlAssertion"):
         redshift_connector.connect(**idp_arg)
 

test/integration/plugin/test_okta_credentials_provider.py

@@ -0,0 +1,29 @@
+import configparser
+import os
+from test import idp_arg
+
+import pytest  # type: ignore
+
+import redshift_connector
+
+conf = configparser.ConfigParser()
+root_path = os.path.dirname(os.path.dirname(os.path.abspath(os.path.join(__file__, os.pardir))))
+conf.read(root_path + "/config.ini")
+
+PROVIDER = ["okta_idp"]
+
+
+@pytest.mark.parametrize("idp_arg", PROVIDER, indirect=True)
+def test_idp_host_invalid_should_fail(idp_arg):
+    wrong_idp_host: str = "andrew.okta.com"
+    idp_arg["idp_host"] = wrong_idp_host
+
+    with pytest.raises(redshift_connector.InterfaceError, match="Unauthorized"):
+        redshift_connector.connect(**idp_arg)
+
+
+@pytest.mark.parametrize("idp_arg", PROVIDER, indirect=True)
+def test_preferred_role_should_use(idp_arg):
+    idp_arg["preferred_role"] = conf.get("okta-idp", "preferred_role")
+    with redshift_connector.connect(**idp_arg):
+        pass

test/unit/mocks/mock_socket.py

@@ -27,3 +27,6 @@ def accept(self):
 
     def recv(self, bufsize, flags=...):
         return self.mocked_data
+
+    def close(self) -> None:
+        pass

test/unit/plugin/data/mock_adfs_saml_response.html

@@ -0,0 +1,11 @@
+<html>
+<head><title>Working...</title></head>
+<body>
+<form method="POST" name="hiddenform" action="https://signin.aws.amazon.com:443/saml"><input type="hidden"
+                                                                                             name="SAMLResponse"
+                                                                                             value="vVdZj9pIEH5faf+DZV7XtPHMZDMWELGgSGg3h4CJon0ZNXYZemV3W93tgeTXb7UP8ME1UZQnoLq66vvqbIbv9klsvYBUTPCRPei7tgU8ECHjm5H9tHrvvLXfjX//bahoEqf+AlQquAILb3Hl58KRnUnuC6qY8jlNQPk68JeTD//4Xt/1Uym0CERsW/PZyH4eeHf3D2/+fPtoW18qp55xOlcqgzlXmnKNItdznYHreIOVd+ffub7r9b2H+39tawZKM051fnOrdap8QhTbcMb7dKf6NKHfBe8HIiEGnW1NDV5j8xLKoFDyM65SCFjEILSRtWVZwxyYLAhfNkKVAmmA2WMDDHEl3xyd4904W6F0H/Y0SWPI0dEwUgQvvLAAFNEyU3pICmel5yLkS011pgpRWzoVIVhfaJzBZWQq1/aXWYC+lG2R0gPpuhhOKhavo9xJ760JbZTBkWYZiZ8RSGMuRPZYJMhTVsUbqqKA0Pxut+vv7vpCbojnui5xHwnqhFhWvSOkmhkI5zwS9ZPycEq54CygMfuel+gH0FsRWpN4IyTT2+SMxwEZuMajA/vACQb3vHfIUcd3TuFmu+59xcRJhISeVNRRW+o9vDntYQERSBwAYD0t5iO7V8toS7u8sJKUq0jIRHXP2ypX8TYiD/wFYpFC6KiKdhfzj3i5Jdp5d1yhZ7zO2Abr8pXpwPj2ziWhYTdv7fHXHEld0sobqSeuUa/kbME2yqnupyWsX/kbvhkz1WB4ZfOUTr8+uI8zqulp3uZ0akZKhF2kK0xt6Qn+p8wOSYn4OAcaDI/iZbb+DwLduPwRp918Zr3H5NMr68NIWOhEuaqfmommNO4T2+Av7DRMl+5wNUXMXDHTtqihK2sq8ddAJchOYE9YNNGwPgr9iX+Sk0iD7Ezhh+MUXuDWS1m+J29ZqqQZ5hPeayFvB3eIeiEzSsrg+wswbnBpRZwh4a1ct67XwDTJQmbaAV8sWrKgAamlYpJ0+N7gdcnIkBxpHIUTjYrrTIPZqZBgQJuoqmPLVMUx1q0gm4STg64iCxFDJ+WH86JRKdYNmvEZTXz/MLXdgedLvE1WSMGY+eO8nkmtg++1FxaCzC98Ln8MSctZM0rV2U1UJYRqyyJ9ie9s/aROFHkLhHkRPIfr50z9eoSTTIupBMzxVZQyg5+J7oZSWeIjD8vS3LsphqrQfzYD57VQa7JuyWOL6S0/yK3858U34eDRw4YvCcx5CPvGq7LV4mgNm1DDXnd7+3g2jfGZivtxfPElG/iB0UPxZ/zYCRli9WucWxDmj4BUSG0mwgm7rZlxAlUpbkUIpdX72fzFIs3/WOP/AQ=="/>
+    <noscript><p>Script is disabled. Click Submit to continue.</p><input type="submit" value="Submit"/></noscript>
+</form>
+<script language="javascript">window.setTimeout('document.forms[0].submit()', 0);</script>
+</body>
+</html>