Honor saml assurance level to allow 2FA bypassing

1 files changed, 28 insertions, 8 deletions

diff --git a/spec/support/helpers/login_helpers.rb b/spec/support/helpers/login_helpers.rb
index 329f18cd288..87cfb6c04dc 100644
--- a/spec/support/helpers/login_helpers.rb
+++ b/spec/support/helpers/login_helpers.rb
@@ -46,8 +46,8 @@ module LoginHelpers
     @current_user = user
   end
 
-  def gitlab_sign_in_via(provider, user, uid)
-    mock_auth_hash(provider, uid, user.email)
+  def gitlab_sign_in_via(provider, user, uid, saml_response = nil)
+    mock_auth_hash(provider, uid, user.email, saml_response)
     visit new_user_session_path
     click_link provider
   end
@@ -87,7 +87,7 @@ module LoginHelpers
     click_link "oauth-login-#{provider}"
   end
 
-  def mock_auth_hash(provider, uid, email)
+  def mock_auth_hash(provider, uid, email, saml_response = nil)
     # The mock_auth configuration allows you to set per-provider (or default)
     # authentication hashes to return during integration testing.
     OmniAuth.config.mock_auth[provider.to_sym] = OmniAuth::AuthHash.new({
@@ -109,12 +109,21 @@ module LoginHelpers
             email: email,
             image: 'mock_user_thumbnail_url'
           }
+        },
+        response_object: {
+          document: saml_xml(saml_response)
         }
       }
     })
     Rails.application.env_config['omniauth.auth'] = OmniAuth.config.mock_auth[provider.to_sym]
   end
 
+  def saml_xml(raw_saml_response)
+    return '' if raw_saml_response.blank?
+
+    XMLSecurity::SignedDocument.new(raw_saml_response, [])
+  end
+
   def mock_saml_config
     OpenStruct.new(name: 'saml', label: 'saml', args: {
       assertion_consumer_service_url: 'https://localhost:3443/users/auth/saml/callback',
@@ -125,6 +134,14 @@ module LoginHelpers
     })
   end
 
+  def mock_saml_config_with_upstream_two_factor_authn_contexts
+    config = mock_saml_config
+    config.args[:upstream_two_factor_authn_contexts] = %w(urn:oasis:names:tc:SAML:2.0:ac:classes:CertificateProtectedTransport
+                                                          urn:oasis:names:tc:SAML:2.0:ac:classes:SecondFactorOTPSMS
+                                                          urn:oasis:names:tc:SAML:2.0:ac:classes:SecondFactorIGTOKEN)
+    config
+  end
+
   def stub_omniauth_provider(provider, context: Rails.application)
     env = env_from_context(context)
 
@@ -140,13 +157,16 @@ module LoginHelpers
     env['omniauth.error.strategy'] = strategy
   end
 
-  def stub_omniauth_saml_config(messages)
-    set_devise_mapping(context: Rails.application)
-    Rails.application.routes.disable_clear_and_finalize = true
-    Rails.application.routes.draw do
+  def stub_omniauth_saml_config(messages,  context: Rails.application)
+    set_devise_mapping(context: context)
+    routes = Rails.application.routes
+    routes.disable_clear_and_finalize = true
+    routes.formatter.clear
+    routes.draw do
       post '/users/auth/saml' => 'omniauth_callbacks#saml'
     end
-    allow(Gitlab::Auth::OAuth::Provider).to receive_messages(providers: [:saml], config_for: mock_saml_config)
+    saml_config = messages.key?(:providers) ? messages[:providers].first : mock_saml_config
+    allow(Gitlab::Auth::OAuth::Provider).to receive_messages(providers: [:saml], config_for: saml_config)
     stub_omniauth_setting(messages)
     stub_saml_authorize_path_helpers
   end