Skip to content

Commit c723571

Browse files
dumbbelldumbbell
committed
Revert "Prevent change of username on token refresh"
This reverts commit 3718fe3.
1 parent 61d1b02 commit c723571

File tree

3 files changed

+10
-76
lines changed

3 files changed

+10
-76
lines changed

‎deps/rabbitmq_auth_backend_oauth2/src/rabbit_auth_backend_oauth2.erl

Lines changed: 5 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -103,26 +103,17 @@ check_topic_access(#auth_user{impl = DecodedTokenFun},
103103
update_state(AuthUser, NewToken) ->
104104
case resolve_resource_server(NewToken) of
105105
{error, _} = Err0 -> Err0;
106-
{ResourceServer, _} = Tuple ->
106+
{_, _} = Tuple ->
107107
case check_token(NewToken, Tuple) of
108108
%% avoid logging the token
109109
{refused, {error, {invalid_token, error, _Err, _Stacktrace}}} ->
110110
{refused, "Authentication using an OAuth 2/JWT token failed: provided token is invalid"};
111111
{refused, Err} ->
112112
{refused, rabbit_misc:format("Authentication using an OAuth 2/JWT token failed: ~tp", [Err])};
113113
{ok, DecodedToken} ->
114-
CurToken = AuthUser#auth_user.impl,
115-
case ensure_same_username(
116-
ResourceServer#resource_server.preferred_username_claims,
117-
CurToken(), DecodedToken) of
118-
ok ->
119-
Tags = tags_from(DecodedToken),
120-
{ok, AuthUser#auth_user{tags = Tags,
121-
impl = fun() -> DecodedToken end}};
122-
{error, mismatch_username_after_token_refresh} ->
123-
{refused,
124-
"Not allowed to change username on refreshed token"}
125-
end
114+
Tags = tags_from(DecodedToken),
115+
{ok, AuthUser#auth_user{tags = Tags,
116+
impl = fun() -> DecodedToken end}}
126117
end
127118
end.
128119

@@ -148,7 +139,7 @@ authenticate(_, AuthProps0) ->
148139
{refused, "Authentication using an OAuth 2/JWT token failed: provided token is invalid", []};
149140
{refused, Err} ->
150141
{refused, "Authentication using an OAuth 2/JWT token failed: ~tp", [Err]};
151-
{ok, DecodedToken} ->
142+
{ok, DecodedToken} ->
152143
Func = fun(Token0) ->
153144
Username = username_from(
154145
ResourceServer#resource_server.preferred_username_claims,
@@ -173,12 +164,6 @@ with_decoded_token(DecodedToken, Fun) ->
173164
rabbit_log:error(Msg),
174165
Err
175166
end.
176-
ensure_same_username(PreferredUsernameClaims, CurrentDecodedToken, NewDecodedToken) ->
177-
CurUsername = username_from(PreferredUsernameClaims, CurrentDecodedToken),
178-
case {CurUsername, username_from(PreferredUsernameClaims, NewDecodedToken)} of
179-
{CurUsername, CurUsername} -> ok;
180-
_ -> {error, mismatch_username_after_token_refresh}
181-
end.
182167

183168
validate_token_expiry(#{<<"exp">> := Exp}) when is_integer(Exp) ->
184169
Now = os:system_time(seconds),

‎deps/rabbitmq_auth_backend_oauth2/test/jwks_SUITE.erl

Lines changed: 1 addition & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -58,8 +58,7 @@ groups() ->
5858
test_failed_connection_with_a_token_with_insufficient_resource_permission,
5959
test_failed_connection_with_algorithm_restriction,
6060
test_failed_token_refresh_case1,
61-
test_failed_token_refresh_case2,
62-
cannot_change_username_on_refreshed_token
61+
test_failed_token_refresh_case2
6362
]},
6463
{no_peer_verification, [], [
6564
{group, happy_path},
@@ -522,11 +521,6 @@ generate_valid_token(Config, Jwk, Scopes, Audience) ->
522521
IncludeKid = rabbit_ct_helpers:get_config(Config, include_kid, true),
523522
?UTIL_MOD:sign_token_hs(Token, Jwk, IncludeKid).
524523

525-
generate_valid_token_with_sub(Config, Jwk, Scopes, Sub) ->
526-
Token = ?UTIL_MOD:token_with_sub(?UTIL_MOD:fixture_token_with_scopes(Scopes), Sub),
527-
IncludeKid = rabbit_ct_helpers:get_config(Config, include_kid, true),
528-
?UTIL_MOD:sign_token_hs(Token, Jwk, IncludeKid).
529-
530524
generate_valid_token_with_extra_fields(Config, ExtraFields) ->
531525
Jwk =
532526
case rabbit_ct_helpers:get_config(Config, fixture_jwk) of
@@ -943,29 +937,6 @@ test_failed_token_refresh_case2(Config) ->
943937

944938
close_connection(Conn).
945939

946-
cannot_change_username_on_refreshed_token(Config) ->
947-
Jwk =
948-
case get_config(Config, fixture_jwk) of
949-
undefined -> ?UTIL_MOD:fixture_jwk();
950-
Value -> Value
951-
end,
952-
{_, CurToken} = generate_valid_token(Config, Jwk, <<"oldUsername">>, [
953-
<<"rabbitmq.configure:vhost4/*">>,
954-
<<"rabbitmq.write:vhost4/*">>,
955-
<<"rabbitmq.read:vhost4/*">>]),
956-
Conn = open_unmanaged_connection(Config, 0, <<"vhost4">>,
957-
<<"oldUsername">>, CurToken),
958-
959-
{_, RefreshToken} = generate_valid_token_with_sub(Config, Jwk, <<"newUsername">>,
960-
[<<"rabbitmq.configure:vhost4/*">>,
961-
<<"rabbitmq.write:vhost4/*">>,
962-
<<"rabbitmq.read:vhost4/*">>]),
963-
964-
%% the error is communicated asynchronously via a connection-level error
965-
?assertException(exit, _, amqp_connection:update_secret(Conn, RefreshToken,
966-
<<"token refresh">>)).
967-
968-
969940
test_failed_connection_with_algorithm_restriction(Config) ->
970941
{_Algo, Token} = get_config(Config, fixture_jwt),
971942
?assertMatch({error, {auth_failure, _}},

‎deps/rabbitmq_auth_backend_oauth2/test/system_SUITE.erl

Lines changed: 4 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -52,8 +52,7 @@ groups() ->
5252

5353
{token_refresh, [], [
5454
test_failed_token_refresh_case1,
55-
test_failed_token_refresh_case2,
56-
refreshed_token_cannot_change_username
55+
test_failed_token_refresh_case2
5756
]},
5857

5958
{extra_scopes_source, [], [
@@ -324,33 +323,21 @@ preconfigure_node(Config) ->
324323

325324
rabbit_ct_helpers:set_config(Config, {fixture_jwk, Jwk}).
326325

327-
generate_valid_token_with_sub(Config, Sub) ->
328-
generate_valid_token(Config,
329-
?UTIL_MOD:full_permission_scopes(), undefined, Sub).
330-
331326
generate_valid_token(Config) ->
332327
generate_valid_token(Config, ?UTIL_MOD:full_permission_scopes()).
333328

334329
generate_valid_token(Config, Scopes) ->
335-
generate_valid_token(Config, Scopes, undefined, undefined).
330+
generate_valid_token(Config, Scopes, undefined).
336331

337332
generate_valid_token(Config, Scopes, Audience) ->
338-
generate_valid_token(Config, Scopes, Audience, undefined).
339-
340-
generate_valid_token(Config, Scopes, Audience, Sub) ->
341333
Jwk = case rabbit_ct_helpers:get_config(Config, fixture_jwk) of
342334
undefined -> ?UTIL_MOD:fixture_jwk();
343335
Value -> Value
344336
end,
345-
Token0 = case Audience of
337+
Token = case Audience of
346338
undefined -> ?UTIL_MOD:fixture_token_with_scopes(Scopes);
347-
DefinedAudience -> maps:put(<<"aud">>, DefinedAudience,
348-
?UTIL_MOD:fixture_token_with_scopes(Scopes))
339+
DefinedAudience -> maps:put(<<"aud">>, DefinedAudience, ?UTIL_MOD:fixture_token_with_scopes(Scopes))
349340
end,
350-
Token = case Sub of
351-
undefined -> Token0;
352-
_ -> maps:put(<<"sub">>, Sub, Token0)
353-
end,
354341
?UTIL_MOD:sign_token_hs(Token, Jwk).
355342

356343
generate_valid_token_with_extra_fields(Config, ExtraFields) ->
@@ -926,15 +913,6 @@ test_failed_token_refresh_case1(Config) ->
926913

927914
close_connection(Conn).
928915

929-
refreshed_token_cannot_change_username(Config) ->
930-
{_, Token} = generate_valid_token_with_sub(Config, <<"username">>),
931-
Conn = open_unmanaged_connection(Config, 0, <<"vhost4">>, <<"username">>, Token),
932-
{_, RefreshedToken} = generate_valid_token_with_sub(Config, <<"username2">>),
933-
934-
%% the error is communicated asynchronously via a connection-level error
935-
?assertException(exit, {{nodedown,not_allowed},_}, amqp_connection:update_secret(Conn, RefreshedToken, <<"token refresh">>)).
936-
937-
938916
test_failed_token_refresh_case2(Config) ->
939917
{_Algo, Token} = generate_valid_token(Config, [<<"rabbitmq.configure:vhost4/*">>,
940918
<<"rabbitmq.write:vhost4/*">>,

0 commit comments

Comments
 (0)