Status list: Full test

[hugoib]

Keycloak: Plugin in progress. It is being tested.

We need testing of the whole status list flow.

Integration between keycloack - Status list - server - Wallet.

[mbunwe-victor]

This ticket has been placed on hold since task #415 blocks it.

[Ogenbertrand]

Below you'll find all the steps for testing the plugin with the statuslist server.

• I am starting the plugin with this compose file:

services:
  postgres:
    image: postgres:15
    environment:
      POSTGRES_DB: keycloak
      POSTGRES_USER: keycloak
      POSTGRES_PASSWORD: keycloak
    volumes:
      - postgres_data:/var/lib/postgresql/data
    ports:
      - "5432:5432"
    networks:
      - keycloak-network

  keycloak:
    image: quay.io/keycloak/keycloak:25.0.2
    environment:
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://postgres:5432/keycloak
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: keycloak
      KC_HOSTNAME_STRICT: "false"
      KC_HTTP_ENABLED: "true"
      KC_HOSTNAME_STRICT_HTTPS: "false"
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin
      KC_LOG_LEVEL: INFO
    ports:
      - "8080:8080"
    volumes:
      - ./target/keycloak-token-status-plugin-1.0.0-SNAPSHOT.jar:/opt/keycloak/providers/keycloak-token-status-plugin.jar
    depends_on:
      - postgres
    networks:
      - keycloak-network
    command: start-dev

networks:
  keycloak-network:
    driver: bridge

volumes:
  postgres_data:

The compose file is going to load the jar file from the target package when starting keycloak.

• I wrote this script to help automates the configuration of a Keycloak realm to enable the Token Status Plugin's credential. It connects Keycloak to our deployed statuslist servere: https://statuslist.eudi-adorsys.com/. It liminates the manual process of setting realm attributes and ensures proper integration with the status list server:

#!/bin/bash

# Keycloak Realm Configuration Script for Token Status Plugin
# Using Keycloak Admin CLI (kcadm.sh) inside the container

REALM_NAME="${REALM_NAME:-master}"
STATUS_LIST_SERVER_URL="${STATUS_LIST_SERVER_URL:-https://statuslist.eudi-adorsys.com/}"
KEYCLOAK_CONTAINER="token-status-link-keycloak-1"

# Check if help is requested
if [ "$1" = "--help" ] || [ "$1" = "-h" ]; then
    echo "Usage: $0 [OPTIONS]"
    echo ""
    echo "Configure Keycloak realm for Token Status Plugin"
    echo ""
    echo "Options:"
    echo "  --realm REALM          Realm name (default: master)"
    echo "  --server-url URL       Status list server URL"
    echo "  --help                 Show this help message"
    echo ""
    echo "Environment variables:"
    echo "  REALM_NAME             Realm name (default: master)"
    echo "  STATUS_LIST_SERVER_URL Status list server URL"
    exit 0
fi

# Parse simple arguments
while [ $# -gt 0 ]; do
    case $1 in
        --realm)
            REALM_NAME="$2"
            shift 2
            ;;
        --server-url)
            STATUS_LIST_SERVER_URL="$2"
            shift 2
            ;;
        *)
            echo "Unknown option: $1"
            echo "Use --help for usage information"
            exit 1
            ;;
    esac
done

echo "=== Keycloak Token Status Plugin Configuration ==="
echo "Realm: $REALM_NAME"
echo "Status List Server: $STATUS_LIST_SERVER_URL"
echo ""

# Check if container is running
echo "Checking if Keycloak container is running..."
if ! docker ps | grep -q "$KEYCLOAK_CONTAINER"; then
    echo "ERROR: Keycloak container '$KEYCLOAK_CONTAINER' is not running."
    echo "Please start the Keycloak service first with: docker-compose up -d"
    exit 1
fi
echo "Keycloak container is running."
echo ""

# Login to Keycloak using kcadm.sh
echo "Logging in to Keycloak using Admin CLI..."
docker exec "$KEYCLOAK_CONTAINER" /opt/keycloak/bin/kcadm.sh config credentials --server http://localhost:8080 --realm master --user admin --password admin

if [ $? -ne 0 ]; then
    echo "ERROR: Failed to login to Keycloak."
    exit 1
fi
echo "Successfully logged in to Keycloak."
echo ""

# Check if realm exists
echo "Checking if realm '$REALM_NAME' exists..."
REALM_EXISTS=$(docker exec "$KEYCLOAK_CONTAINER" /opt/keycloak/bin/kcadm.sh get realms/"$REALM_NAME" 2>/dev/null | jq -r '.realm // "null"')

if [ "$REALM_EXISTS" != "$REALM_NAME" ]; then
    echo "ERROR: Realm '$REALM_NAME' does not exist."
    echo "Please create the realm first."
    exit 1
fi
echo "Realm '$REALM_NAME' exists."
echo ""

# Set realm attributes
echo "Setting realm attributes..."
docker exec "$KEYCLOAK_CONTAINER" /opt/keycloak/bin/kcadm.sh update realms/"$REALM_NAME" \
    -s 'attributes.status-list-enabled=true' \
    -s "attributes.status-list-server-url=$STATUS_LIST_SERVER_URL" \
    -s 'attributes.status-list-connect-timeout=30000' \
    -s 'attributes.status-list-read-timeout=60000' \
    -s 'attributes.status-list-retry-count=3'

if [ $? -ne 0 ]; then
    echo "ERROR: Failed to set realm attributes."
    exit 1
fi
echo "Realm attributes set successfully."
echo ""

# Enable event listener
echo "Enabling token status event listener..."
# Get current event listeners
CURRENT_LISTENERS=$(docker exec "$KEYCLOAK_CONTAINER" /opt/keycloak/bin/kcadm.sh get realms/"$REALM_NAME" | jq -r '.eventsListeners // []')

# Add our listener if not already present
LISTENER_EXISTS=$(echo "$CURRENT_LISTENERS" | jq 'index("token-status-event-listener")')

if [ "$LISTENER_EXISTS" = "null" ]; then
    UPDATED_LISTENERS=$(echo "$CURRENT_LISTENERS" | jq '. + ["token-status-event-listener"]')
    
    # Update the realm with the new listeners
    docker exec "$KEYCLOAK_CONTAINER" /opt/keycloak/bin/kcadm.sh update realms/"$REALM_NAME" \
        --body "{\"eventsListeners\": $UPDATED_LISTENERS}"
    
    if [ $? -ne 0 ]; then
        echo "ERROR: Failed to enable event listener."
        exit 1
    fi
    echo "Event listener enabled successfully."
else
    echo "Event listener is already enabled."
fi
echo ""

# Verify configuration
echo "Verifying configuration..."
VERIFIED_CONFIG=$(docker exec "$KEYCLOAK_CONTAINER" /opt/keycloak/bin/kcadm.sh get realms/"$REALM_NAME")

ENABLED=$(echo "$VERIFIED_CONFIG" | jq -r '.attributes."status-list-enabled" // "false"')
SERVER_URL=$(echo "$VERIFIED_CONFIG" | jq -r '.attributes."status-list-server-url" // "not set"')
LISTENERS=$(echo "$VERIFIED_CONFIG" | jq -r '.eventsListeners // []')

echo "Configuration verification:"
echo "  - Service enabled: $ENABLED"
echo "  - Server URL: $SERVER_URL"
echo "  - Event listeners: $LISTENERS"

if [ "$ENABLED" = "true" ] && [ "$SERVER_URL" != "not set" ]; then
    LISTENER_CHECK=$(echo "$LISTENERS" | jq 'index("token-status-event-listener")')
    if [ "$LISTENER_CHECK" != "null" ]; then
        echo ""
        echo "Configuration verified successfully!"
    else
        echo "WARNING: Event listener not found in configuration."
        exit 1
    fi
else
    echo "ERROR: Configuration verification failed."
    exit 1
fi

echo ""
echo "SUCCESS: Keycloak realm '$REALM_NAME' is now configured for Token Status Plugin!"
echo "The credential revocation service should now be enabled and working."
echo ""
echo "You can test the service with:"
echo "  curl -X GET \"http://localhost:8080/realms/${REALM_NAME}/credential-revocation/status\" \\"
echo "    -H \"Authorization: Bearer \$(curl -s -X POST 'http://localhost:8080/realms/${REALM_NAME}/protocol/openid-connect/token' \\"
echo "      -H 'Content-Type: application/x-www-form-urlencoded' \\"
echo "      -d 'username=admin' \\"
echo "      -d 'password=admin' \\"
echo "      -d 'grant_type=password' \\"
echo "      -d 'client_id=admin-cli' | jq -r '.access_token')\""

• Start the script using the command: ./configure-realm-cli.sh --realm master --server-url https://statuslist.eudi-adorsys.com/

• Get an Access Token from keycloak:

• Test the server endpoint using the token generated by keycloak: