@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
33name : " Authentication"
44crdName : authentications.config.openshift.io
55featureGates :
6- - ExternalOIDCWithNewAuthConfigFields
6+ - ExternalOIDCWithUpstreamParity
77tests :
88 onCreate :
99 - name : Valid discoveryURL
@@ -416,11 +416,10 @@ tests:
416416 claimValidationRules:
417417 - type: Expression
418418 expressionRule:
419- expression: "{{longExpression}}"
420- replacements :
421- longExpression : " {{'x' * 5000}}"
422- expectedError : " expression: Too long: must have at most 4096 characters"
419+ expression: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
423420
421+ expectedError : " spec.oidcProviders[0].claimValidationRules[0].expressionRule.expression: Too long"
422+
424423 - name : Empty expression in expressionRule
425424 initial : |
426425 apiVersion: config.openshift.io/v1
@@ -441,10 +440,10 @@ tests:
441440 claimValidationRules:
442441 - type: Expression
443442 expressionRule:
444- expression : ""
443+ sexpression : ""
445444 message: "must not be empty"
446- expectedError : " expression: Invalid value: \"\" : validation failed: value length must be at least 1 "
447-
445+ expectedError : " spec.oidcProviders[0].claimValidationRules[0].expressionRule. expression: Required value"
446+
448447 - name : Valid TokenUserValidationRule with expression and message
449448 initial : |
450449 apiVersion: config.openshift.io/v1
@@ -457,11 +456,11 @@ tests:
457456 issuerURL: https://meh.tld
458457 audiences: ['openshift-aud']
459458 claimMappings:
460- username:
461- claim: "preferred_username"
462- prefixPolicy: Prefix
463- prefix:
464- prefixString: "myoidc:"
459+ username:
460+ claim: "preferred_username"
461+ prefixPolicy: Prefix
462+ prefix:
463+ prefixString: "myoidc:"
465464 userValidationRules:
466465 - expression: "user.username.startsWith('admin')"
467466 message: "Only admin users are allowed"
@@ -476,11 +475,11 @@ tests:
476475 issuerURL: https://meh.tld
477476 audiences: ['openshift-aud']
478477 claimMappings:
479- username:
480- claim: "preferred_username"
481- prefixPolicy: Prefix
482- prefix:
483- prefixString: "myoidc:"
478+ username:
479+ claim: "preferred_username"
480+ prefixPolicy: Prefix
481+ prefix:
482+ prefixString: "myoidc:"
484483 userValidationRules:
485484 - expression: "user.username.startsWith('admin')"
486485 message: "Only admin users are allowed"
@@ -497,11 +496,11 @@ tests:
497496 issuerURL: https://meh.tld
498497 audiences: ['openshift-aud']
499498 claimMappings:
500- username:
501- claim: "preferred_username"
502- prefixPolicy: Prefix
503- prefix:
504- prefixString: "myoidc:"
499+ username:
500+ claim: "preferred_username"
501+ prefixPolicy: Prefix
502+ prefix:
503+ prefixString: "myoidc:"
505504 userValidationRules:
506505 - message: "Should never reach here"
507506 expectedError : " expression: Required value"
@@ -518,17 +517,15 @@ tests:
518517 issuerURL: https://meh.tld
519518 audiences: ['openshift-aud']
520519 claimMappings:
521- username:
522- claim: "preferred_username"
523- prefixPolicy: Prefix
524- prefix:
525- prefixString: "myoidc:"
520+ username:
521+ claim: "preferred_username"
522+ prefixPolicy: Prefix
523+ prefix:
524+ prefixString: "myoidc:"
526525 userValidationRules:
527- - expression: "{{longExpression}} "
526+ - expression: "aaaaaaaaaabhdgbshfghdfklgfdlhsfghfdsgdfusurghughurhghrgushgelurhglurhgukshjfdhjghfdughdfuhgushrgjhrgjhulhruhgurhgusrhughrughrsuhrughsughuhlgiusrhruighluirshguhrguhrluighlugihlrughruhgurhgurlhgrujhgurhsurhlughuisrhurhgurhegushguhseughreughruhguhreughrseuhlrushlghlruhglhur "
528527 message: "This expression is too long"
529- replacements :
530- longExpression : " {{'x' * 5000}}"
531- expectedError : " expression: Too long: must have at most 4096 characters"
528+ expectedError : " expression: Too long"
532529
533530 - name : Empty expression in TokenUserValidationRule
534531 initial : |
@@ -542,15 +539,16 @@ tests:
542539 issuerURL: https://meh.tld
543540 audiences: ['openshift-aud']
544541 claimMappings:
545- username:
546- claim: "preferred_username"
547- prefixPolicy: Prefix
548- prefix:
549- prefixString: "myoidc:"
542+ username:
543+ claim: "preferred_username"
544+ prefixPolicy: Prefix
545+ prefix:
546+ prefixString: "myoidc:"
550547 userValidationRules:
551548 - expression: ""
552549 message: "Empty expressions are invalid"
553- expectedError : " expression: Invalid value: \"\" : validation failed: value length must be at least 1"
550+ expectedError : " spec.oidcProviders[0].userValidationRules[0].expression: Invalid value: \"\" : spec.oidcProviders[0].userValidationRules[0].expression in body should be at least 1 chars long"
551+
554552
555553 - name : Valid TokenUserValidationRule with expression only
556554 initial : |
@@ -564,11 +562,11 @@ tests:
564562 issuerURL: https://meh.tld
565563 audiences: ['openshift-aud']
566564 claimMappings:
567- username:
568- claim: "preferred_username"
569- prefixPolicy: Prefix
570- prefix:
571- prefixString: "myoidc:"
565+ username:
566+ claim: "preferred_username"
567+ prefixPolicy: Prefix
568+ prefix:
569+ prefixString: "myoidc:"
572570 userValidationRules:
573571 - expression: "user.groups.exists(g, g == 'admins')"
574572 expected : |
@@ -582,10 +580,10 @@ tests:
582580 issuerURL: https://meh.tld
583581 audiences: ['openshift-aud']
584582 claimMappings:
585- username:
586- claim: "preferred_username"
587- prefixPolicy: Prefix
588- prefix:
589- prefixString: "myoidc:"
583+ username:
584+ claim: "preferred_username"
585+ prefixPolicy: Prefix
586+ prefix:
587+ prefixString: "myoidc:"
590588 userValidationRules:
591589 - expression: "user.groups.exists(g, g == 'admins')"
0 commit comments