Skip to content

Commit bb2c8cc

Browse files
bunglebungle
committed
feat(ldap-auth) set generic X-Credential-Identifier (deprecating X-Credential-Username)
### Summary The PR Kong#4993 implemented `X-Credential-Identifier` for `JWT Plugin` and it was decided at time that we should add support for this less opinionated field name on other auth plugins too. This commit adds it to `LDAP Auth Plugin`.
1 parent 301bf89 commit bb2c8cc

File tree

3 files changed

+46
-33
lines changed

3 files changed

+46
-33
lines changed

‎kong/plugins/ldap-auth/access.lua

Lines changed: 22 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -165,42 +165,37 @@ local function set_consumer(consumer, credential)
165165
local set_header = kong.service.request.set_header
166166
local clear_header = kong.service.request.clear_header
167167

168-
if consumer then
169-
-- this can only be the Anonymous user in this case
170-
if consumer.id then
171-
set_header(constants.HEADERS.CONSUMER_ID, consumer.id)
172-
else
173-
clear_header(constants.HEADERS.CONSUMER_ID)
174-
end
175-
176-
if consumer.custom_id then
177-
set_header(constants.HEADERS.CONSUMER_CUSTOM_ID, consumer.custom_id)
178-
else
179-
clear_header(constants.HEADERS.CONSUMER_CUSTOM_ID)
180-
end
181-
182-
if consumer.username then
183-
set_header(constants.HEADERS.CONSUMER_USERNAME, consumer.username)
184-
else
185-
clear_header(constants.HEADERS.CONSUMER_USERNAME)
186-
end
168+
if consumer and consumer.id then
169+
set_header(constants.HEADERS.CONSUMER_ID, consumer.id)
170+
else
171+
clear_header(constants.HEADERS.CONSUMER_ID)
172+
end
187173

188-
set_header(constants.HEADERS.ANONYMOUS, true)
174+
if consumer and consumer.custom_id then
175+
set_header(constants.HEADERS.CONSUMER_CUSTOM_ID, consumer.custom_id)
176+
else
177+
clear_header(constants.HEADERS.CONSUMER_CUSTOM_ID)
178+
end
189179

190-
return
180+
if consumer and consumer.username then
181+
set_header(constants.HEADERS.CONSUMER_USERNAME, consumer.username)
182+
else
183+
clear_header(constants.HEADERS.CONSUMER_USERNAME)
191184
end
192185

193186
if credential and credential.username then
187+
set_header(constants.HEADERS.CREDENTIAL_IDENTIFIER, credential.username)
194188
set_header(constants.HEADERS.CREDENTIAL_USERNAME, credential.username)
195189
else
190+
clear_header(constants.HEADERS.CREDENTIAL_IDENTIFIER)
196191
clear_header(constants.HEADERS.CREDENTIAL_USERNAME)
197192
end
198193

199-
-- in case of auth plugins concatenation, remove remnants of anonymous
200-
clear_header(constants.HEADERS.ANONYMOUS)
201-
clear_header(constants.HEADERS.CONSUMER_ID)
202-
clear_header(constants.HEADERS.CONSUMER_CUSTOM_ID)
203-
clear_header(constants.HEADERS.CONSUMER_USERNAME)
194+
if credential then
195+
clear_header(constants.HEADERS.ANONYMOUS)
196+
else
197+
set_header(constants.HEADERS.ANONYMOUS, true)
198+
end
204199
end
205200

206201

@@ -264,7 +259,7 @@ function _M.execute(conf)
264259
return kong.response.exit(500, { message = "An unexpected error occurred" })
265260
end
266261

267-
set_consumer(consumer, nil)
262+
set_consumer(consumer)
268263

269264
else
270265
return kong.response.exit(err.status, { message = err.message }, err.headers)

‎kong/plugins/ldap-auth/handler.lua

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,15 @@
11
local access = require "kong.plugins.ldap-auth.access"
22

33

4-
local LdapAuthHandler = {}
4+
local LdapAuthHandler = {
5+
PRIORITY = 1002,
6+
VERSION = "2.2.0",
7+
}
58

69

710
function LdapAuthHandler:access(conf)
811
access.execute(conf)
912
end
1013

1114

12-
LdapAuthHandler.PRIORITY = 1002
13-
LdapAuthHandler.VERSION = "2.1.0"
14-
15-
1615
return LdapAuthHandler

‎spec/03-plugins/20-ldap-auth/01-access_spec.lua

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -287,6 +287,8 @@ for _, ldap_strategy in pairs(ldap_strategies) do
287287
}
288288
})
289289
assert.response(res).has.status(200)
290+
local value = assert.request(res).has.header("x-credential-identifier")
291+
assert.are.equal("einstein", value)
290292
local value = assert.request(res).has.header("x-credential-username")
291293
assert.are.equal("einstein", value)
292294
assert.request(res).has_not.header("x-anonymous-username")
@@ -411,6 +413,8 @@ for _, ldap_strategy in pairs(ldap_strategies) do
411413
}
412414
})
413415
assert.response(res).has.status(200)
416+
local value = assert.request(res).has.header("x-credential-identifier")
417+
assert.are.equal("einstein", value)
414418
local value = assert.request(res).has.header("x-credential-username")
415419
assert.are.equal("einstein", value)
416420
assert.request(res).has_not.header("x-anonymous-username")
@@ -464,6 +468,8 @@ for _, ldap_strategy in pairs(ldap_strategies) do
464468
})
465469
assert.response(res).has.status(200)
466470

471+
local value = assert.request(res).has.header("x-credential-identifier")
472+
assert.are.equal("einstein", value)
467473
local value = assert.request(res).has.header("x-credential-username")
468474
assert.are.equal("einstein", value)
469475
assert.request(res).has_not.header("x-anonymous-username")
@@ -481,6 +487,8 @@ for _, ldap_strategy in pairs(ldap_strategies) do
481487
assert.are.equal("true", value)
482488
value = assert.request(res).has.header("x-consumer-username")
483489
assert.equal('no-body', value)
490+
assert.request(res).has.no.header("x-credential-identifier")
491+
assert.request(res).has.no.header("x-credential-username")
484492
end)
485493
it("errors when anonymous user doesn't exist", function()
486494
local res = assert(proxy_client:send {
@@ -499,6 +507,7 @@ for _, ldap_strategy in pairs(ldap_strategies) do
499507
local proxy_client
500508
local user
501509
local anonymous
510+
local keyauth
502511

503512
lazy_setup(function()
504513
local bp = helpers.get_db_utils(strategy, {
@@ -573,7 +582,7 @@ for _, ldap_strategy in pairs(ldap_strategies) do
573582
},
574583
}
575584

576-
bp.keyauth_credentials:insert {
585+
keyauth = bp.keyauth_credentials:insert {
577586
key = "Mouse",
578587
consumer = { id = user.id },
579588
}
@@ -665,6 +674,9 @@ for _, ldap_strategy in pairs(ldap_strategies) do
665674
local id = assert.request(res).has.header("x-consumer-id")
666675
assert.not_equal(id, anonymous.id)
667676
assert(id == user.id)
677+
local value = assert.request(res).has.header("x-credential-identifier")
678+
assert.equal(keyauth.id, value)
679+
assert.request(res).has.no.header("x-credential-username")
668680
end)
669681

670682
it("passes with only the first credential provided", function()
@@ -681,6 +693,9 @@ for _, ldap_strategy in pairs(ldap_strategies) do
681693
local id = assert.request(res).has.header("x-consumer-id")
682694
assert.not_equal(id, anonymous.id)
683695
assert.equal(user.id, id)
696+
local value = assert.request(res).has.header("x-credential-identifier")
697+
assert.equal(keyauth.id, value)
698+
assert.request(res).has.no.header("x-credential-username")
684699
end)
685700

686701
it("passes with only the second credential provided", function()
@@ -694,6 +709,8 @@ for _, ldap_strategy in pairs(ldap_strategies) do
694709
})
695710
assert.response(res).has.status(200)
696711
assert.request(res).has.no.header("x-anonymous-consumer")
712+
local id = assert.request(res).has.header("x-credential-identifier")
713+
assert.equal("einstein", id)
697714
local id = assert.request(res).has.header("x-credential-username")
698715
assert.equal("einstein", id)
699716
end)
@@ -710,6 +727,8 @@ for _, ldap_strategy in pairs(ldap_strategies) do
710727
assert.request(res).has.header("x-anonymous-consumer")
711728
local id = assert.request(res).has.header("x-consumer-id")
712729
assert.equal(id, anonymous.id)
730+
assert.request(res).has.no.header("x-credential-identifier")
731+
assert.request(res).has.no.header("x-credential-username")
713732
end)
714733
end)
715734
end)

0 commit comments

Comments
 (0)