providers/proxy: add tests for proxy basic auth (#4357)

* add tests for proxy basic auth

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* stop bandit from complaining

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* add API tests

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* more tests

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

tests/e2e/test_provider_ldap.py

@@ -47,7 +47,6 @@ class TestProviderLDAP(SeleniumTestCase):
 
     def _prepare(self) -> User:
         """prepare user, provider, app and container"""
-        # set additionalHeaders to test later
         self.user.attributes["extraAttribute"] = "bar"
         self.user.save()
 

tests/e2e/test_provider_proxy.py

@@ -1,4 +1,5 @@
 """Proxy and Outpost e2e tests"""
+from base64 import b64encode
 from dataclasses import asdict
 from sys import platform
 from time import sleep
@@ -14,6 +15,7 @@ from authentik import __version__
 from authentik.blueprints.tests import apply_blueprint, reconcile_app
 from authentik.core.models import Application
 from authentik.flows.models import Flow
+from authentik.lib.generators import generate_id
 from authentik.outposts.models import DockerServiceConnection, Outpost, OutpostConfig, OutpostType
 from authentik.outposts.tasks import outpost_local_connection
 from authentik.providers.proxy.models import ProxyProvider
@@ -119,6 +121,78 @@ class TestProviderProxy(SeleniumTestCase):
         full_body_text = self.driver.find_element(By.CSS_SELECTOR, ".pf-c-title.pf-m-3xl").text
         self.assertIn("You've logged out of proxy.", full_body_text)
 
+    @retry()
+    @apply_blueprint(
+        "default/10-flow-default-authentication-flow.yaml",
+        "default/10-flow-default-invalidation-flow.yaml",
+    )
+    @apply_blueprint(
+        "default/20-flow-default-provider-authorization-explicit-consent.yaml",
+        "default/20-flow-default-provider-authorization-implicit-consent.yaml",
+    )
+    @apply_blueprint(
+        "system/providers-oauth2.yaml",
+        "system/providers-proxy.yaml",
+    )
+    @reconcile_app("authentik_crypto")
+    def test_proxy_basic_auth(self):
+        """Test simple outpost setup with single provider"""
+        cred = generate_id()
+        attr = "basic-password"  # nosec
+        self.user.attributes["basic-username"] = cred
+        self.user.attributes[attr] = cred
+        self.user.save()
+
+        proxy: ProxyProvider = ProxyProvider.objects.create(
+            name="proxy_provider",
+            authorization_flow=Flow.objects.get(
+                slug="default-provider-authorization-implicit-consent"
+            ),
+            internal_host="http://localhost",
+            external_host="http://localhost:9000",
+            basic_auth_enabled=True,
+            basic_auth_user_attribute="basic-username",
+            basic_auth_password_attribute=attr,
+        )
+        # Ensure OAuth2 Params are set
+        proxy.set_oauth_defaults()
+        proxy.save()
+        # we need to create an application to actually access the proxy
+        Application.objects.create(name="proxy", slug="proxy", provider=proxy)
+        outpost: Outpost = Outpost.objects.create(
+            name="proxy_outpost",
+            type=OutpostType.PROXY,
+        )
+        outpost.providers.add(proxy)
+        outpost.build_user_permissions(outpost.user)
+
+        self.proxy_container = self.start_proxy(outpost)
+
+        # Wait until outpost healthcheck succeeds
+        healthcheck_retries = 0
+        while healthcheck_retries < 50:
+            if len(outpost.state) > 0:
+                state = outpost.state[0]
+                if state.last_seen:
+                    break
+            healthcheck_retries += 1
+            sleep(0.5)
+        sleep(5)
+
+        self.driver.get("http://localhost:9000")
+        self.login()
+        sleep(1)
+
+        full_body_text = self.driver.find_element(By.CSS_SELECTOR, "pre").text
+        self.assertIn(f"X-Authentik-Username: {self.user.username}", full_body_text)
+        auth_header = b64encode(f"{cred}:{cred}".encode()).decode()
+        self.assertIn(f"Authorization: Basic {auth_header}", full_body_text)
+
+        self.driver.get("http://localhost:9000/outpost.goauthentik.io/sign_out")
+        sleep(2)
+        full_body_text = self.driver.find_element(By.CSS_SELECTOR, ".pf-c-title.pf-m-3xl").text
+        self.assertIn("You've logged out of proxy.", full_body_text)
+
 
 @skipUnless(platform.startswith("linux"), "requires local docker")
 class TestProviderProxyConnect(ChannelsLiveServerTestCase):