add: testcases for SNI in JWT provider

agent/xds/clusters_test.go

@@ -230,29 +230,44 @@ func TestMakeJWTProviderCluster(t *testing.T) {
 			},
 			expectedError: "cannot create JWKS cluster for non remote JWKS. Provider Name: okta",
 		},
+		"https-provider-with-hostname-no-port-with-sni": {
+			provider: makeTestProviderWithJWKS("https://example-okta.com/.well-known/jwks.json", true),
+		},
 		"https-provider-with-hostname-no-port": {
-			provider: makeTestProviderWithJWKS("https://example-okta.com/.well-known/jwks.json"),
+			provider: makeTestProviderWithJWKS("https://example-okta.com/.well-known/jwks.json", false),
 		},
 		"http-provider-with-hostname-no-port": {
-			provider: makeTestProviderWithJWKS("http://example-okta.com/.well-known/jwks.json"),
+			provider: makeTestProviderWithJWKS("http://example-okta.com/.well-known/jwks.json", true),
+		},
+		"http-provider-with-hostname-no-port-with-sni": {
+			provider: makeTestProviderWithJWKS("http://example-okta.com/.well-known/jwks.json", true),
 		},
 		"https-provider-with-hostname-and-port": {
-			provider: makeTestProviderWithJWKS("https://example-okta.com:90/.well-known/jwks.json"),
+			provider: makeTestProviderWithJWKS("https://example-okta.com:90/.well-known/jwks.json", false),
 		},
 		"http-provider-with-hostname-and-port": {
-			provider: makeTestProviderWithJWKS("http://example-okta.com:90/.well-known/jwks.json"),
+			provider: makeTestProviderWithJWKS("http://example-okta.com:90/.well-known/jwks.json", false),
+		},
+		"http-provider-with-hostname-and-port-with-sni": {
+			provider: makeTestProviderWithJWKS("http://example-okta.com:90/.well-known/jwks.json", true),
+		},
+		"https-provider-with-ip-no-port-with-sni": {
+			provider: makeTestProviderWithJWKS("https://127.0.0.1", true),
 		},
 		"https-provider-with-ip-no-port": {
-			provider: makeTestProviderWithJWKS("https://127.0.0.1"),
+			provider: makeTestProviderWithJWKS("https://127.0.0.1", false),
 		},
 		"http-provider-with-ip-no-port": {
-			provider: makeTestProviderWithJWKS("http://127.0.0.1"),
+			provider: makeTestProviderWithJWKS("http://127.0.0.1", false),
+		},
+		"https-provider-with-ip-and-port-with-sni": {
+			provider: makeTestProviderWithJWKS("https://127.0.0.1:9091", true),
 		},
 		"https-provider-with-ip-and-port": {
-			provider: makeTestProviderWithJWKS("https://127.0.0.1:9091"),
+			provider: makeTestProviderWithJWKS("https://127.0.0.1:9091", false),
 		},
 		"http-provider-with-ip-and-port": {
-			provider: makeTestProviderWithJWKS("http://127.0.0.1:9091"),
+			provider: makeTestProviderWithJWKS("http://127.0.0.1:9091", true),
 		},
 	}
 
@@ -272,11 +287,12 @@ func TestMakeJWTProviderCluster(t *testing.T) {
 	}
 }
 
-func makeTestProviderWithJWKS(uri string) *structs.JWTProviderConfigEntry {
+func makeTestProviderWithJWKS(uri string, useSNI bool) *structs.JWTProviderConfigEntry {
 	return &structs.JWTProviderConfigEntry{
 		Kind:   "jwt-provider",
 		Name:   "okta",
 		Issuer: "test-issuer",
+		UseSNI: useSNI,
 		JSONWebKeySet: &structs.JSONWebKeySet{
 			Remote: &structs.RemoteJWKS{
 				RequestTimeoutMs:    1000,

agent/xds/testdata/clusters/connect-proxy-with-jwt-config-entry-with-remote-jwks.latest.golden

@@ -138,8 +138,7 @@
                 "filename": "mycert.crt"
               }
             }
-          },
-          "sni": "test.test.com"
+          }
         }
       },
       "type": "STATIC"

agent/xds/testdata/jwt_authn_clusters/http-provider-with-hostname-and-port-with-sni.golden

@@ -0,0 +1,24 @@
+{
+  "connectTimeout": "5s",
+  "loadAssignment": {
+    "clusterName": "jwks_cluster_okta",
+    "endpoints": [
+      {
+        "lbEndpoints": [
+          {
+            "endpoint": {
+              "address": {
+                "socketAddress": {
+                  "address": "example-okta.com",
+                  "portValue": 90
+                }
+              }
+            }
+          }
+        ]
+      }
+    ]
+  },
+  "name": "jwks_cluster_okta",
+  "type": "STATIC"
+}

agent/xds/testdata/jwt_authn_clusters/http-provider-with-hostname-no-port-with-sni.golden

@@ -0,0 +1,24 @@
+{
+  "connectTimeout": "5s",
+  "loadAssignment": {
+    "clusterName": "jwks_cluster_okta",
+    "endpoints": [
+      {
+        "lbEndpoints": [
+          {
+            "endpoint": {
+              "address": {
+                "socketAddress": {
+                  "address": "example-okta.com",
+                  "portValue": 80
+                }
+              }
+            }
+          }
+        ]
+      }
+    ]
+  },
+  "name": "jwks_cluster_okta",
+  "type": "STATIC"
+}

agent/xds/testdata/jwt_authn_clusters/https-provider-with-hostname-and-port.golden

@@ -30,8 +30,7 @@
             "filename": "mycert.crt"
           }
         }
-      },
-      "sni": "example-okta.com"
+      }
     }
   },
   "type": "STATIC"

agent/xds/testdata/jwt_authn_clusters/https-provider-with-hostname-no-port-with-sni.golden

@@ -0,0 +1,38 @@
+{
+  "connectTimeout": "5s",
+  "loadAssignment": {
+    "clusterName": "jwks_cluster_okta",
+    "endpoints": [
+      {
+        "lbEndpoints": [
+          {
+            "endpoint": {
+              "address": {
+                "socketAddress": {
+                  "address": "example-okta.com",
+                  "portValue": 443
+                }
+              }
+            }
+          }
+        ]
+      }
+    ]
+  },
+  "name": "jwks_cluster_okta",
+  "transportSocket": {
+    "name": "tls",
+    "typedConfig": {
+      "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+      "commonTlsContext": {
+        "validationContext": {
+          "trustedCa": {
+            "filename": "mycert.crt"
+          }
+        }
+      },
+      "sni": "example-okta.com"
+    }
+  },
+  "type": "STATIC"
+}

agent/xds/testdata/jwt_authn_clusters/https-provider-with-hostname-no-port.golden

@@ -30,8 +30,7 @@
             "filename": "mycert.crt"
           }
         }
-      },
-      "sni": "example-okta.com"
+      }
     }
   },
   "type": "STATIC"

agent/xds/testdata/jwt_authn_clusters/https-provider-with-ip-and-port-with-sni.golden

@@ -0,0 +1,38 @@
+{
+  "connectTimeout": "5s",
+  "loadAssignment": {
+    "clusterName": "jwks_cluster_okta",
+    "endpoints": [
+      {
+        "lbEndpoints": [
+          {
+            "endpoint": {
+              "address": {
+                "socketAddress": {
+                  "address": "127.0.0.1",
+                  "portValue": 9091
+                }
+              }
+            }
+          }
+        ]
+      }
+    ]
+  },
+  "name": "jwks_cluster_okta",
+  "transportSocket": {
+    "name": "tls",
+    "typedConfig": {
+      "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+      "commonTlsContext": {
+        "validationContext": {
+          "trustedCa": {
+            "filename": "mycert.crt"
+          }
+        }
+      },
+      "sni": "127.0.0.1"
+    }
+  },
+  "type": "STATIC"
+}

agent/xds/testdata/jwt_authn_clusters/https-provider-with-ip-and-port.golden

@@ -30,8 +30,7 @@
             "filename": "mycert.crt"
           }
         }
-      },
-      "sni": "127.0.0.1"
+      }
     }
   },
   "type": "STATIC"

agent/xds/testdata/jwt_authn_clusters/https-provider-with-ip-no-port-with-sni.golden

@@ -0,0 +1,38 @@
+{
+  "connectTimeout": "5s",
+  "loadAssignment": {
+    "clusterName": "jwks_cluster_okta",
+    "endpoints": [
+      {
+        "lbEndpoints": [
+          {
+            "endpoint": {
+              "address": {
+                "socketAddress": {
+                  "address": "127.0.0.1",
+                  "portValue": 443
+                }
+              }
+            }
+          }
+        ]
+      }
+    ]
+  },
+  "name": "jwks_cluster_okta",
+  "transportSocket": {
+    "name": "tls",
+    "typedConfig": {
+      "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+      "commonTlsContext": {
+        "validationContext": {
+          "trustedCa": {
+            "filename": "mycert.crt"
+          }
+        }
+      },
+      "sni": "127.0.0.1"
+    }
+  },
+  "type": "STATIC"
+}

agent/xds/testdata/jwt_authn_clusters/https-provider-with-ip-no-port.golden

@@ -30,8 +30,7 @@
             "filename": "mycert.crt"
           }
         }
-      },
-      "sni": "127.0.0.1"
+      }
     }
   },
   "type": "STATIC"