chore: revision

tests/providers/okta/services/signon/signon_dod_warning_banner_configured/signon_dod_warning_banner_configured_test.py

@@ -58,6 +58,7 @@ class Test_signon_dod_warning_banner_configured:
             assert "DOD Notice and Consent Banner detected" in (
                 findings[0].status_extended
             )
+            assert "customized sign-in page" in findings[0].status_extended
 
     def test_fail_when_customized_page_missing_banner(self):
         page = sign_in_page(
@@ -83,7 +84,31 @@ class Test_signon_dod_warning_banner_configured:
             assert findings[0].status == "FAIL"
             assert "does not contain" in findings[0].status_extended
 
-    def test_manual_when_no_customization(self):
+    def test_pass_when_default_page_contains_banner(self):
+        page = sign_in_page(
+            brand_id="brand-1",
+            brand_name="Primary",
+            is_customized=False,
+            page_content=f"<html><body>{DOD_BANNER_HTML_SNIPPET}</body></html>",
+        )
+        signon_client = build_signon_client(sign_in_pages={"brand-1": page})
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_okta_provider(),
+            ),
+            mock.patch(CHECK_PATH, new=signon_client),
+        ):
+            from prowler.providers.okta.services.signon.signon_dod_warning_banner_configured.signon_dod_warning_banner_configured import (
+                signon_dod_warning_banner_configured,
+            )
+
+            findings = signon_dod_warning_banner_configured().execute()
+            assert len(findings) == 1
+            assert findings[0].status == "PASS"
+            assert "default sign-in page" in findings[0].status_extended
+
+    def test_manual_when_page_content_missing(self):
         page = sign_in_page(
             brand_id="brand-1",
             brand_name="Primary",
@@ -105,7 +130,9 @@ class Test_signon_dod_warning_banner_configured:
             findings = signon_dod_warning_banner_configured().execute()
             assert len(findings) == 1
             assert findings[0].status == "MANUAL"
-            assert "No customized sign-in page" in findings[0].status_extended
+            assert "could not be retrieved from the Okta API" in (
+                findings[0].status_extended
+            )
 
     def test_manual_when_fetch_error(self):
         page = sign_in_page(
@@ -132,6 +159,33 @@ class Test_signon_dod_warning_banner_configured:
             assert "Could not retrieve" in findings[0].status_extended
             assert "403" in findings[0].status_extended
 
+    def test_fail_when_only_partial_banner_markers_are_present(self):
+        page = sign_in_page(
+            brand_id="brand-1",
+            brand_name="Primary",
+            is_customized=True,
+            page_content=(
+                "<html><body>This U.S. Government portal is for authorized use "
+                "only.</body></html>"
+            ),
+        )
+        signon_client = build_signon_client(sign_in_pages={"brand-1": page})
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_okta_provider(),
+            ),
+            mock.patch(CHECK_PATH, new=signon_client),
+        ):
+            from prowler.providers.okta.services.signon.signon_dod_warning_banner_configured.signon_dod_warning_banner_configured import (
+                signon_dod_warning_banner_configured,
+            )
+
+            findings = signon_dod_warning_banner_configured().execute()
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert "does not contain" in findings[0].status_extended
+
     def test_emits_one_finding_per_brand(self):
         compliant = sign_in_page(
             brand_id="brand-prod",
@@ -149,6 +203,7 @@ class Test_signon_dod_warning_banner_configured:
             brand_id="brand-legacy",
             brand_name="Legacy",
             is_customized=False,
+            page_content=f"<html>{DOD_BANNER_HTML_SNIPPET}</html>",
         )
         signon_client = build_signon_client(
             sign_in_pages={
@@ -174,5 +229,5 @@ class Test_signon_dod_warning_banner_configured:
             assert by_brand == {
                 "brand-prod": "PASS",
                 "brand-sandbox": "FAIL",
-                "brand-legacy": "MANUAL",
+                "brand-legacy": "PASS",
             }

tests/providers/okta/services/signon/signon_global_session_lifetime_18h/signon_global_session_lifetime_18h_test.py

@@ -120,6 +120,33 @@ class Test_signon_global_session_lifetime_18h:
             assert findings[0].status == "FAIL"
             assert "does not define" in findings[0].status_extended
 
+    def test_fail_when_lifetime_is_disabled_with_zero(self):
+        policy = default_policy(
+            [
+                non_default_rule("Unlimited Lifetime", lifetime_min=0, priority=1),
+                default_rule(priority=2),
+            ]
+        )
+        signon_client = build_signon_client({"pol-default": policy})
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_okta_provider(),
+            ),
+            mock.patch(CHECK_PATH, new=signon_client),
+        ):
+            from prowler.providers.okta.services.signon.signon_global_session_lifetime_18h.signon_global_session_lifetime_18h import (
+                signon_global_session_lifetime_18h,
+            )
+
+            findings = signon_global_session_lifetime_18h().execute()
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert "0 minutes" in findings[0].status_extended
+            assert "disables the maximum Okta global session lifetime" in (
+                findings[0].status_extended
+            )
+
     def test_fail_when_default_rule_is_priority_one(self):
         policy = default_policy(
             [

tests/providers/okta/services/signon/signon_service_test.py

@@ -192,6 +192,7 @@ class Test_Signon_service_brands:
         provider,
         brands_response,
         sign_in_page_responses: dict,
+        default_sign_in_page_responses: dict | None = None,
     ):
         async def fake_list_policies(*_a, **_k):
             return ([], _resp({}), None)
@@ -202,6 +203,9 @@ class Test_Signon_service_brands:
         async def fake_get_sign_in_page(brand_id, *_a, **_k):
             return sign_in_page_responses[brand_id]
 
+        async def fake_get_default_sign_in_page(brand_id, *_a, **_k):
+            return default_sign_in_page_responses[brand_id]
+
         with mock.patch(
             "prowler.providers.okta.lib.service.service.OktaSDKClient"
         ) as mocked_client_cls:
@@ -209,6 +213,7 @@ class Test_Signon_service_brands:
             mocked.list_policies = fake_list_policies
             mocked.list_brands = fake_list_brands
             mocked.get_customized_sign_in_page = fake_get_sign_in_page
+            mocked.get_default_sign_in_page = fake_get_default_sign_in_page
             mocked_client_cls.return_value = mocked
             return Signon(provider)
 
@@ -229,7 +234,27 @@ class Test_Signon_service_brands:
         assert result.page_content == "<html>banner here</html>"
         assert result.fetch_error is None
 
-    def test_404_marks_brand_as_not_customized(self):
+    def test_404_falls_back_to_default_sign_in_page(self):
+        provider = set_mocked_okta_provider()
+        brand = _fake_brand("brand-1", "Primary")
+        default_page = _fake_sign_in_page("<html>default banner here</html>")
+        service = self._build_with_brands(
+            provider,
+            brands_response=([brand], _resp({}), None),
+            sign_in_page_responses={
+                "brand-1": (None, _resp({}), Exception("404 Not Found"))
+            },
+            default_sign_in_page_responses={"brand-1": (default_page, _resp({}), None)},
+        )
+
+        assert service.sign_in_pages["brand-1"].is_customized is False
+        assert service.sign_in_pages["brand-1"].fetch_error is None
+        assert (
+            service.sign_in_pages["brand-1"].page_content
+            == "<html>default banner here</html>"
+        )
+
+    def test_default_sign_in_page_error_captured_when_customized_page_missing(self):
         provider = set_mocked_okta_provider()
         brand = _fake_brand("brand-1", "Primary")
         service = self._build_with_brands(
@@ -238,10 +263,14 @@ class Test_Signon_service_brands:
             sign_in_page_responses={
                 "brand-1": (None, _resp({}), Exception("404 Not Found"))
             },
+            default_sign_in_page_responses={
+                "brand-1": (None, _resp({}), Exception("403 Forbidden"))
+            },
         )
 
-        assert service.sign_in_pages["brand-1"].is_customized is False
-        assert service.sign_in_pages["brand-1"].fetch_error is None
+        result = service.sign_in_pages["brand-1"]
+        assert result.is_customized is False
+        assert "403" in result.fetch_error
 
     def test_403_captured_into_fetch_error(self):
         provider = set_mocked_okta_provider()
@@ -252,6 +281,7 @@ class Test_Signon_service_brands:
             sign_in_page_responses={
                 "brand-1": (None, _resp({}), Exception("403 Forbidden: invalid_scope"))
             },
+            default_sign_in_page_responses={},
         )
 
         result = service.sign_in_pages["brand-1"]
@@ -291,8 +321,16 @@ class Test_Signon_service_brands:
                 "brand-a": (page_a, _resp({}), None),
                 "brand-b": (None, _resp({}), Exception("404 not found")),
             },
+            default_sign_in_page_responses={
+                "brand-b": (
+                    _fake_sign_in_page("<html>default B</html>"),
+                    _resp({}),
+                    None,
+                )
+            },
         )
 
         assert set(service.sign_in_pages.keys()) == {"brand-a", "brand-b"}
         assert service.sign_in_pages["brand-a"].page_content == "<html>A</html>"
         assert service.sign_in_pages["brand-b"].is_customized is False
+        assert service.sign_in_pages["brand-b"].page_content == "<html>default B</html>"