Merge branch 'master' of github.com:gambol99/keycloak-proxy

handlers.go

@@ -24,9 +24,11 @@ import (
 	"net/http"
 	"net/url"
 	"path"
+	"strings"
 	"time"
 
 	log "github.com/Sirupsen/logrus"
+	"github.com/coreos/go-oidc/oauth2"
 	"github.com/gin-gonic/gin"
 )
 
@@ -234,6 +236,15 @@ func (r *oauthProxy) loginHandler(cx *gin.Context) {
 	// step: request the access token via
 	token, err := client.UserCredsToken(username, password)
 	if err != nil {
+		if strings.HasPrefix(err.Error(), oauth2.ErrorInvalidGrant) {
+			log.WithFields(log.Fields{
+				"client_ip": cx.ClientIP(),
+				"error":     err.Error(),
+			}).Errorf("invalid user credentials provided")
+
+			cx.AbortWithStatus(http.StatusUnauthorized)
+			return
+		}
 		log.WithFields(log.Fields{
 			"client_ip": cx.ClientIP(),
 			"error":     err.Error(),

handlers_test.go

@@ -112,6 +112,11 @@ func TestLoginHandler(t *testing.T) {
 			Password:     "test",
 			ExpectedCode: http.StatusOK,
 		},
+		{
+			Username:     "test",
+			Password:     "notmypassword",
+			ExpectedCode: http.StatusUnauthorized,
+		},
 	}
 
 	for i, x := range cs {

oauth_test.go

@@ -76,6 +76,11 @@ Ka0WPQGKjQJhZRtqDAT3sfnrEEUa34+MkXQeKFCu6Yi0dRFic4iqOYU=
 -----END RSA PRIVATE KEY-----
 `
 
+const (
+	validUsername = "test"
+	validPassword = "test"
+)
+
 type fakeDiscoveryResponse struct {
 	AuthorizationEndpoint            string   `json:"authorization_endpoint"`
 	EndSessionEndpoint               string   `json:"end_session_endpoint"`
@@ -227,12 +232,19 @@ func (r *fakeOAuthServer) tokenHandler(cx *gin.Context) {
 			cx.AbortWithStatus(http.StatusBadRequest)
 			return
 		}
+		if username == validUsername && password == validPassword {
 			cx.JSON(http.StatusOK, tokenResponse{
 				IDToken:      token.Encode(),
 				AccessToken:  token.Encode(),
 				RefreshToken: token.Encode(),
 				ExpiresIn:    expiration.Second(),
 			})
+			return
+		}
+		cx.JSON(http.StatusUnauthorized, gin.H{
+			"error":             "invalid_grant",
+			"error_description": "Invalid user credentials",
+		})
 	case oauth2.GrantTypeAuthCode:
 		cx.JSON(http.StatusOK, tokenResponse{
 			IDToken:      token.Encode(),