zydronium/google-nomulus
1
0
Fork 0
mirror of https://github.com/google/nomulus.git synced 2025-04-30 12:07:51 +02:00
Code Issues Projects Releases Packages Wiki Activity

Use the Proxy-Authorization header when using nomulus + IAP (#1921)

Browse source
This commit is contained in:
gbrodman 2023-01-26 15:16:32 -05:00 • committed by GitHub
parent ab146c4bf8
commit bd66b3cef1
2 changed files with 8 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
core/src/main/java/google/registry/tools/RequestFactoryModule.java
View file

@ -69,14 +69,15 @@ class RequestFactoryModule {
return new NetHttpTransport() return new NetHttpTransport()
.createRequestFactory( .createRequestFactory(
request -> { request -> {
// Use the standard credential initializer to set the Authorization header
credentialsBundle.getHttpRequestInitializer().initialize(request);
// If using IAP, use the refresh token to acquire an IAP-enabled ID token and use // If using IAP, use the refresh token to acquire an IAP-enabled ID token and use
// that for authentication. // that for authentication.
if (iapClientId.isPresent()) { if (iapClientId.isPresent()) {
String idToken = getIdToken(credentialsBundle, iapClientId.get()); String idToken = getIdToken(credentialsBundle, iapClientId.get());
request.getHeaders().setAuthorization("Bearer " + idToken); // Set the Proxy-Authentication header so that IAP can read from it, see
} else { // https://cloud.google.com/iap/docs/authentication-howto#authenticating_from_proxy-authorization_header
// Otherwise, use the standard credential HTTP initializer request.getHeaders().set("Proxy-Authorization", "Bearer " + idToken);
credentialsBundle.getHttpRequestInitializer().initialize(request);
} }
// GAE request times out after 10 min, so here we set the timeout to 10 min. This is // GAE request times out after 10 min, so here we set the timeout to 10 min. This is
// needed to support some nomulus commands like updating premium lists that take // needed to support some nomulus commands like updating premium lists that take

4
core/src/test/java/google/registry/tools/RequestFactoryModuleTest.java
View file

@ -100,6 +100,7 @@ public class RequestFactoryModuleTest {
@Test @Test
void test_provideHttpRequestFactory_remote_withIap() throws Exception { void test_provideHttpRequestFactory_remote_withIap() throws Exception {
when(credentialsBundle.getHttpRequestInitializer()).thenReturn(httpRequestInitializer);
// Mock the request/response to/from the IAP server requesting an ID token // Mock the request/response to/from the IAP server requesting an ID token
UserCredentials mockUserCredentials = mock(UserCredentials.class); UserCredentials mockUserCredentials = mock(UserCredentials.class);
when(credentialsBundle.getGoogleCredentials()).thenReturn(mockUserCredentials); when(credentialsBundle.getGoogleCredentials()).thenReturn(mockUserCredentials);
@ -123,9 +124,10 @@ public class RequestFactoryModuleTest {
RequestFactoryModule.provideHttpRequestFactory( RequestFactoryModule.provideHttpRequestFactory(
credentialsBundle, Optional.of("iapClientId")); credentialsBundle, Optional.of("iapClientId"));
HttpRequest request = factory.buildGetRequest(new GenericUrl("http://localhost")); HttpRequest request = factory.buildGetRequest(new GenericUrl("http://localhost"));
assertThat(request.getHeaders().getAuthorization()).isEqualTo("Bearer iapIdToken"); assertThat(request.getHeaders().get("Proxy-Authorization")).isEqualTo("Bearer iapIdToken");
assertThat(request.getConnectTimeout()).isEqualTo(REQUEST_TIMEOUT_MS); assertThat(request.getConnectTimeout()).isEqualTo(REQUEST_TIMEOUT_MS);
assertThat(request.getReadTimeout()).isEqualTo(REQUEST_TIMEOUT_MS); assertThat(request.getReadTimeout()).isEqualTo(REQUEST_TIMEOUT_MS);
verify(httpRequestInitializer).initialize(request);
verifyNoMoreInteractions(httpRequestInitializer); verifyNoMoreInteractions(httpRequestInitializer);
} finally { } finally {
RegistryConfig.CONFIG_SETTINGS.get().gcpProject.isLocal = origIsLocal; RegistryConfig.CONFIG_SETTINGS.get().gcpProject.isLocal = origIsLocal;