Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[QA] 2.1.0 Testplan #179

Closed
jnweiger opened this issue Sep 14, 2021 · 3 comments
Closed

[QA] 2.1.0 Testplan #179

jnweiger opened this issue Sep 14, 2021 · 3 comments

Comments

@jnweiger
Copy link
Contributor

jnweiger commented Sep 14, 2021 •
edited by jesmrec
Loading

Setup

Test instances:

Setup details (click to view)

Automated setup script: https://github.com/owncloud-docker/compose-playground/blob/master/examples/hetzner-deploy/make_openidconnect_test.sh

References:

Testplan

Test Case Description Expected Result Comments
Installation
Fresh install occ app:enable openidconnect app gets enabled ✔️
Fresh install disable/enable via admin web gui app gets disabled/enabled ✔️
Update from 1.0.0 disable, unpack new tar, enable via admin web gui app gets enabled ✔️ occ upgrade is needed. #135
User flow
Correct OIDC URL Set a correct OIDC URL Connection set to the URL ✔️ as per INIT.bashrc
Enter correct iDP credentials 1. Set a correct OIDC URL
2. Enter correct credentials		 Authorization is requested ✔️
Authorization Authorize permissions and session iDP finishes web browser and redirects to the client ✔️
Cancel login process 1. Set a correct OIDC URL
2. In iDP, cancel login process
 Back to client ✔️ Error in OpenIdConnect:Error: access_denied Description: consent denied
Logout 1. Complete login process in a OIDC server
2. Logout in the idP		 Session logged out. Needed credentials again to enter the account ✔️ Stranded at kopano-url, oc-url would be better
Request flow
Check openid-configuration request Enter an URL of OIDC server The .well-known /openid-configuration endpoint must be checked to assure availability of OIDC. Response received ✔️
register endpoint available In case the server supports Dynamic Client Registration, register endpoint is requested Client id and secret id (not mandatory) is retrieved ✔️
idP flow Enter credentials in iDP The logon endpoint is requested after entering credentials
The authorize endpoint is requested after authorizing		 ✔️ /signin/v1/chooseaccount
/signin/v1/identifier
/signin/v1/consent
http://localhost:44155/
idP flow with dynamic client registration Enter credentials in iDP The logon endpoint is requested after entering credentials
The authorize endpoint is requested after authorizing using client id and secret id granted by register endpoint
Redirection Authorize session in idP Web browser redirects correctly to the client and with session opened ✔️
Token Renewal Wait till session time is exceed token endoint is requested with refresh token to get a new token. This must be transparent for the client ⛔ Expeted logging not seen ( 01-22 09:10:46:385 [ info sync.httplogger ]: ... "expires_in": 600\n}\n]"
01-22 09:21:03:624 [ info sync.credentials.http ]: Refreshing token
01-22 09:21:03:759 [ info sync.httplogger ]: ... Request: POST ... /konnect/v1/token) -> https://github.com/owncloud/openidconnect/issues/182
ClientId/SecretiD renewal Wait till clientId/SecretId granted by register endpoint, expire New ClientId/SecretId must be granted to request new tokens 🦘 renewal seen after 10 minutes. See log example below #132 (comment)
Migration
Basic -> OIDC 1. Login in basic auth server
2. Enable maintenance mode and upgrade to OIDC
3. add 'token_auth_enforced' => true to config.php
4. Disable maintenance mode;		 Client continues working in basic auth, until user logs out, then oidc starts. ✔️ Discussion of expected behaviour in #136
OAuth2 -> OIDC 1. Login in OAuth2 server
2. Enable maintenance mode and upgrade to OIDC
3. Disable maintenance mode		 Token not valid anymore, and user must re-authenticate against new OIDC ✔️ :
OAuth2 -> OIDC + OAuth2 1. Login in OAuth2 server
2. Enable maintenance mode and upgrade to OIDC, keeping Oauth2 enabled
3. Disable maintenance mode		 Token remains valid. Must re-login to start using OIDC ✔️ :

Android

Openidconnect: 2.1.0RC2
Device: Google Pixel 2
Android version: 11

Test Case Description Expected Result Comments
User flow
Correct OIDC URL Set a correct OIDC URL Connection set to the URL ✔️
Enter correct iDP credentials 1. Set a correct OIDC URL
2. Enter correct credentials		 Authorization is requested ✔️
Authorization Authorize permissions and session iDP finishes web browser and redirects to the client ✔️
Cancel login process 1. Set a correct OIDC URL
2. In iDP, cancel login process
 Back to client ✔️
Logout 1. Complete login process in a OIDC server
2. Logout in the idP		 Session logged out. Needed credentials again to enter the account NA
Request flow
Check openid-configuration request Enter an URL of OIDC server The .well-known /openid-configuration endpoint must be checked to assure availability of OIDC. Response received ✔️
register endpoint available In case the server supports Dynamic Client Registration, register endpoint is requested Client id and secret id (not mandatory) is retrieved ✔️
idP flow Enter credentials in iDP The logon endpoint is requested after entering credentials
The authorize endpoint is requested after authorizing		 ✔️
idP flow with dynamic client registration Enter credentials in iDP The logon endpoint is requested after entering credentials
The authorize endpoint is requested after authorizing using client id and secret id granted by register endpoint		 ✔️
Redirection Authorize session in idP Web browser redirects correctly to the client and with session opened ✔️
Renewal Wait till session time is exceed token endoint is requested with refresh token to get a new token. This must be transparent for the client NA Pending of client/secret renewal
ClientId/SecretId renewal Wait till clientId/SecretId granted by register endpoint, expire New ClientId/SecretId must be granted to request new tokens NA Android does not support yet
Migration
Basic -> OIDC 1. Login in basic auth server
2. Enable maintenance mode and upgrade to OIDC
3. Disable maintenance mode
4. Force re-login		 User must re-authenticate against new OIDC ✔️
OAuth2 -> OIDC 1. Login in OAuth2 server
2. Enable maintenance mode and upgrade to OIDC
3. Disable maintenance mode		 Token not valid anymore, and user must re-authenticate against new OIDC ✔️

iOS

Openidconnect: 2.1.0RC2
Device: iPhoneXR
iOS version: 15.0

Test Case Description Expected Result Comments
User flow
Correct OIDC URL Set a correct OIDC URL Connection set to the URL ✔️
Enter correct iDP credentials 1. Set a correct OIDC URL
2. Enter correct credentials		 Authorization is requested ✔️
Authorization Authorize permissions and session iDP finishes web browser and redirects to the client ✔️
Cancel login process 1. Set a correct OIDC URL
2. In iDP, cancel login process
 Back to client ✔️
Logout 1. Complete login process in a OIDC server
2. Logout in the idP		 Session logged out. Needed credentials again to enter the account NA
Request flow
Check openid-configuration request Enter an URL of OIDC server The .well-known /openid-configuration endpoint must be checked to assure availability of OIDC. Response received ✔️
register endpoint available In case the server supports Dynamic Client Registration, register endpoint is requested Client id and secret id (not mandatory) is retrieved ✔️
idP flow Enter credentials in iDP The logon endpoint is requested after entering credentials
The authorize endpoint is requested after authorizing		 ✔️
idP flow with dynamic client registration Enter credentials in iDP The authorize endpoint is requested after authorizing using client id and secret id granted by register endpoint ✔️
Redirection Authorize session in idP Web browser redirects correctly to the client and with session opened ✔️
Renewal Wait till session time is exceed token endpoint is requested with refresh token to get a new token. This must be transparent for the client NA Pending of client/secret renewal
ClientId/SecretId renewal Wait till clientId/SecretId granted by register endpoint, expire New ClientId/SecretId must be granted to request new tokens NA
Migration
Basic -> OIDC 1. Login in basic auth server
2. Enable maintenance mode and upgrade to OIDC
3. Disable maintenance mode
4. Force re-login		 User must re-authenticate against new OIDC NA Not supported. Link
OAuth2 -> OIDC 1. Login in OAuth2 server
2. Enable maintenance mode and upgrade to OIDC
3. Disable maintenance mode		 Token not valid anymore, and user must re-authenticate against new OIDC ✔️
@jnweiger jnweiger mentioned this issue Sep 14, 2021
Closed
45 tasks
@jnweiger
Copy link
Contributor Author

jnweiger commented Sep 15, 2021 •
edited
Loading

changelog testing

@jnweiger
Copy link
Contributor Author

jnweiger commented Nov 3, 2021 •
edited
Loading

Test Plan for #167

  • Add no settings at all
    • Enable app. Test login
    • Expected behaviour: App fails the same way as previous release:
      • openid-connect => array(), leads to "Error, the provider URL has not been set"
      • no openid-connect key in config: Alternative Login buttons (e.g. Kopano) are not shown.
  • Add no settings to DB
    • Add valid settings to config.php (default way, not altered)
    • Remove any existing config settings in DB
      • mysql -h db --user=owncloud --password=owncloud owncloud
      • select * from oc_appconfig where appid='openidconnect' no configkey 'openid-connect'
    • Enable app. Test login
    • Expected behaviour: Login should work
  • Add invalid settings to DB
    • Add valid settings to config.php (default way, not altered)
    • Add settings to DB as stated in Readme (https://github.com/owncloud/openidconnect#settings-in-database) but use a malformed JSON string e.g.
      • insert into oc_appconfig set appid='openidconnect', configkey='openid-connect', configvalue='{}'
      • update oc_appconfig set configvalue='{ "foo: 42 }' where configkey='openid-connect';
    • Enable app. Test login
    • Expected behaviour:
      • Login should work
      • ownCloud.log should contain an error message, see

        openidconnect/lib/Client.php

        Line 102 in fd9ae9e

        'Loaded config from DB is not valid (malformed JSON); JSON Last Error: ' . json_last_error(),
  • Add valid settings to DB
    • Add settings to DB as stated in Readme (https://github.com/owncloud/openidconnect#settings-in-database)
      • update oc_appconfig set configvalue='{ "provider-url": "https://konnect-oidc-210rc2-20211031.jw-qa.owncloud.works", "client-id": "ownCloud", "client-secret": "ownCloud", "loginButtonName": "Kopano", "autoRedirectOnLoginPage": false, "redirect-url": "https://oc1080-oidc-210rc2-20211031.jw-qa.owncloud.works/index.php/apps/openidconnect/redirect", "mode": "userid", "search-attribute": "preferred_username" }' where configkey='openid-connect';
    • Enable app. Test login
    • Expected behaviour: Login should work

@jesmrec
Copy link

jesmrec commented Nov 16, 2021

@jnweiger no objections from my side. Regular uses cases working fine, and known restrictions are still there, but no blockers.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@jnweiger @jesmrec