feat(oauth): Add integration tests with Ory Hydra & Authelia

oauth2/core/src/intTest/java/com/dremio/iceberg/authmgr/oauth2/agent/OAuth2AgentAutheliaIT.java

@@ -0,0 +1,142 @@
+/*
+ * Copyright (C) 2025 Dremio Corporation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.dremio.iceberg.authmgr.oauth2.agent;
+
+import static com.dremio.iceberg.authmgr.oauth2.test.junit.AutheliaExtension.CLIENT_ID1;
+import static com.dremio.iceberg.authmgr.oauth2.test.junit.AutheliaExtension.CLIENT_ID2;
+import static com.dremio.iceberg.authmgr.oauth2.test.junit.AutheliaExtension.CLIENT_SECRET1;
+import static com.dremio.iceberg.authmgr.oauth2.test.junit.AutheliaExtension.CLIENT_SECRET2;
+import static com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod.CLIENT_SECRET_BASIC;
+import static com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod.CLIENT_SECRET_POST;
+import static org.assertj.core.api.InstanceOfAssertFactories.type;
+
+import com.dremio.iceberg.authmgr.oauth2.flow.OAuth2Exception;
+import com.dremio.iceberg.authmgr.oauth2.flow.TokensResult;
+import com.dremio.iceberg.authmgr.oauth2.test.ImmutableTestEnvironment.Builder;
+import com.dremio.iceberg.authmgr.oauth2.test.TestEnvironment;
+import com.dremio.iceberg.authmgr.oauth2.test.junit.AutheliaExtension;
+import com.nimbusds.jwt.JWT;
+import com.nimbusds.jwt.JWTParser;
+import com.nimbusds.oauth2.sdk.ErrorObject;
+import com.nimbusds.oauth2.sdk.GrantType;
+import com.nimbusds.oauth2.sdk.auth.Secret;
+import com.nimbusds.oauth2.sdk.id.ClientID;
+import com.nimbusds.oauth2.sdk.token.AccessToken;
+import java.io.InputStream;
+import java.net.URI;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.text.ParseException;
+import java.util.Objects;
+import org.assertj.core.api.SoftAssertions;
+import org.assertj.core.api.junit.jupiter.InjectSoftAssertions;
+import org.assertj.core.api.junit.jupiter.SoftAssertionsExtension;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.api.io.TempDir;
+
+@ExtendWith(AutheliaExtension.class)
+@ExtendWith(SoftAssertionsExtension.class)
+public class OAuth2AgentAutheliaIT {
+
+  @InjectSoftAssertions private SoftAssertions soft;
+
+  private static Path keyStorePath;
+
+  @BeforeAll
+  static void beforeAll(@TempDir Path tempDir) throws Exception {
+    keyStorePath = tempDir.resolve("keystore.p12");
+    try (InputStream is =
+        OAuth2AgentAutheliaIT.class.getResourceAsStream("/openssl/keystore.p12")) {
+      Files.copy(Objects.requireNonNull(is), keyStorePath);
+    }
+  }
+
+  @Test
+  void clientSecretBasic(Builder envBuilder) throws Exception {
+    try (TestEnvironment env =
+            envBuilder
+                .grantType(GrantType.CLIENT_CREDENTIALS)
+                .clientAuthenticationMethod(CLIENT_SECRET_BASIC)
+                .clientId(new ClientID(CLIENT_ID1))
+                .clientSecret(new Secret(CLIENT_SECRET1))
+                .sslTrustAll(false)
+                .sslTrustStorePath(keyStorePath)
+                .sslTrustStorePassword("s3cr3t")
+                .build();
+        OAuth2Agent agent = env.newAgent()) {
+      assertAgent(agent, CLIENT_ID1, env.getAuthorizationServerUrl());
+    }
+  }
+
+  @Test
+  void clientSecretPost(Builder envBuilder) throws Exception {
+    try (TestEnvironment env =
+            envBuilder
+                .grantType(GrantType.CLIENT_CREDENTIALS)
+                .clientAuthenticationMethod(CLIENT_SECRET_POST)
+                .clientId(new ClientID(CLIENT_ID2))
+                .clientSecret(new Secret(CLIENT_SECRET2))
+                .sslTrustAll(false)
+                .sslTrustStorePath(keyStorePath)
+                .sslTrustStorePassword("s3cr3t")
+                .build();
+        OAuth2Agent agent = env.newAgent()) {
+      assertAgent(agent, CLIENT_ID2, env.getAuthorizationServerUrl());
+    }
+  }
+
+  @Test
+  void unauthorizedBadClientSecret(Builder envBuilder) {
+    try (TestEnvironment env =
+            envBuilder
+                .clientSecret(new Secret("BAD SECRET"))
+                .sslTrustAll(false)
+                .sslTrustStorePath(keyStorePath)
+                .sslTrustStorePassword("s3cr3t")
+                .build();
+        OAuth2Agent agent = env.newAgent()) {
+      soft.assertThatThrownBy(agent::authenticate)
+          .asInstanceOf(type(OAuth2Exception.class))
+          .extracting(OAuth2Exception::getErrorObject)
+          .extracting(ErrorObject::getHTTPStatusCode, ErrorObject::getCode)
+          .containsExactly(401, "invalid_client");
+    }
+  }
+
+  private void assertAgent(OAuth2Agent agent, String clientId, URI issuer) throws Exception {
+    // initial grant
+    TokensResult initial = agent.authenticateInternal();
+    introspectToken(initial.getTokens().getAccessToken(), clientId, issuer);
+    soft.assertThat(initial.getTokens().getRefreshToken()).isNull();
+    // fetch new tokens
+    TokensResult renewed = agent.fetchNewTokens().toCompletableFuture().get();
+    introspectToken(renewed.getTokens().getAccessToken(), clientId, issuer);
+    soft.assertThat(renewed.getTokens().getRefreshToken()).isNull();
+  }
+
+  private void introspectToken(AccessToken accessToken, String clientId, URI issuer)
+      throws ParseException {
+    soft.assertThat(accessToken).isNotNull();
+    JWT jwt = JWTParser.parse(accessToken.getValue());
+    soft.assertThat(jwt).isNotNull();
+    String actualIssuer = jwt.getJWTClaimsSet().getIssuer();
+    String actualClientId = jwt.getJWTClaimsSet().getStringClaim("client_id");
+    soft.assertThat(actualIssuer).isEqualTo(issuer.toString());
+    soft.assertThat(actualClientId).isEqualTo(clientId);
+  }
+}

oauth2/core/src/intTest/java/com/dremio/iceberg/authmgr/oauth2/agent/OAuth2AgentHydraIT.java

@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2025 Dremio Corporation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.dremio.iceberg.authmgr.oauth2.agent;
+
+import static com.dremio.iceberg.authmgr.oauth2.test.junit.HydraExtension.CLIENT_ID1;
+import static com.dremio.iceberg.authmgr.oauth2.test.junit.HydraExtension.CLIENT_ID2;
+import static com.dremio.iceberg.authmgr.oauth2.test.junit.HydraExtension.CLIENT_SECRET1;
+import static com.dremio.iceberg.authmgr.oauth2.test.junit.HydraExtension.CLIENT_SECRET2;
+import static com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod.CLIENT_SECRET_BASIC;
+import static com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod.CLIENT_SECRET_POST;
+import static org.assertj.core.api.InstanceOfAssertFactories.type;
+
+import com.dremio.iceberg.authmgr.oauth2.flow.OAuth2Exception;
+import com.dremio.iceberg.authmgr.oauth2.flow.TokensResult;
+import com.dremio.iceberg.authmgr.oauth2.http.HttpClientType;
+import com.dremio.iceberg.authmgr.oauth2.test.ImmutableTestEnvironment.Builder;
+import com.dremio.iceberg.authmgr.oauth2.test.TestEnvironment;
+import com.dremio.iceberg.authmgr.oauth2.test.container.HydraContainer;
+import com.dremio.iceberg.authmgr.oauth2.test.junit.HydraExtension;
+import com.nimbusds.jwt.JWT;
+import com.nimbusds.jwt.JWTParser;
+import com.nimbusds.oauth2.sdk.ErrorObject;
+import com.nimbusds.oauth2.sdk.GrantType;
+import com.nimbusds.oauth2.sdk.auth.Secret;
+import com.nimbusds.oauth2.sdk.id.ClientID;
+import com.nimbusds.oauth2.sdk.token.AccessToken;
+import java.text.ParseException;
+import org.assertj.core.api.SoftAssertions;
+import org.assertj.core.api.junit.jupiter.InjectSoftAssertions;
+import org.assertj.core.api.junit.jupiter.SoftAssertionsExtension;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.junitpioneer.jupiter.cartesian.CartesianTest;
+import org.junitpioneer.jupiter.cartesian.CartesianTest.Enum;
+
+@ExtendWith(HydraExtension.class)
+@ExtendWith(SoftAssertionsExtension.class)
+public class OAuth2AgentHydraIT {
+
+  @InjectSoftAssertions private SoftAssertions soft;
+
+  @CartesianTest
+  void clientSecretBasic(@Enum HttpClientType httpClientType, Builder envBuilder) throws Exception {
+    try (TestEnvironment env =
+            envBuilder
+                .httpClientType(httpClientType)
+                .grantType(GrantType.CLIENT_CREDENTIALS)
+                .clientAuthenticationMethod(CLIENT_SECRET_BASIC)
+                .clientId(new ClientID(CLIENT_ID1))
+                .clientSecret(new Secret(CLIENT_SECRET1))
+                .build();
+        OAuth2Agent agent = env.newAgent()) {
+      assertAgent(agent, CLIENT_ID1);
+    }
+  }
+
+  @CartesianTest
+  void clientSecretPost(@Enum HttpClientType httpClientType, Builder envBuilder) throws Exception {
+    try (TestEnvironment env =
+            envBuilder
+                .httpClientType(httpClientType)
+                .grantType(GrantType.CLIENT_CREDENTIALS)
+                .clientAuthenticationMethod(CLIENT_SECRET_POST)
+                .clientId(new ClientID(CLIENT_ID2))
+                .clientSecret(new Secret(CLIENT_SECRET2))
+                .build();
+        OAuth2Agent agent = env.newAgent()) {
+      assertAgent(agent, CLIENT_ID2);
+    }
+  }
+
+  @Test
+  void unauthorizedBadClientSecret(Builder envBuilder) {
+    try (TestEnvironment env = envBuilder.clientSecret(new Secret("BAD SECRET")).build();
+        OAuth2Agent agent = env.newAgent()) {
+      soft.assertThatThrownBy(agent::authenticate)
+          .asInstanceOf(type(OAuth2Exception.class))
+          .extracting(OAuth2Exception::getErrorObject)
+          .extracting(ErrorObject::getHTTPStatusCode, ErrorObject::getCode)
+          .containsExactly(401, "invalid_client");
+    }
+  }
+
+  private void assertAgent(OAuth2Agent agent, String clientId) throws Exception {
+    // initial grant
+    TokensResult initial = agent.authenticateInternal();
+    introspectToken(initial.getTokens().getAccessToken(), clientId);
+    soft.assertThat(initial.getTokens().getRefreshToken()).isNull();
+    // fetch new tokens
+    TokensResult renewed = agent.fetchNewTokens().toCompletableFuture().get();
+    introspectToken(renewed.getTokens().getAccessToken(), clientId);
+    soft.assertThat(renewed.getTokens().getRefreshToken()).isNull();
+  }
+
+  private void introspectToken(AccessToken accessToken, String clientId) throws ParseException {
+    soft.assertThat(accessToken).isNotNull();
+    JWT jwt = JWTParser.parse(accessToken.getValue());
+    soft.assertThat(jwt).isNotNull();
+    String actualIssuer = jwt.getJWTClaimsSet().getIssuer();
+    String actualClientId = jwt.getJWTClaimsSet().getStringClaim("client_id");
+    String actualSubject = jwt.getJWTClaimsSet().getStringClaim("sub");
+    String actualScope = jwt.getJWTClaimsSet().getStringArrayClaim("scp")[0];
+    soft.assertThat(actualIssuer).isEqualTo(HydraContainer.ISSUER_URL);
+    soft.assertThat(actualClientId).isEqualTo(clientId);
+    soft.assertThat(actualSubject).isEqualTo(clientId);
+    soft.assertThat(actualScope).isEqualTo("catalog");
+  }
+}

oauth2/core/src/intTest/java/com/dremio/iceberg/authmgr/oauth2/agent/OAuth2AgentKeycloakIT.java

@@ -226,7 +226,7 @@ void httpsCallback(
       @EnumLike CodeChallengeMethod method, Builder envBuilder, @TempDir Path tempDir)
       throws Exception {
     Path keyStorePath = tempDir.resolve("keystore.p12");
-    try (InputStream is = getClass().getResourceAsStream("/openssl/mockserver.p12")) {
+    try (InputStream is = getClass().getResourceAsStream("/openssl/keystore.p12")) {
       Files.copy(Objects.requireNonNull(is), keyStorePath);
     }
     try (TestEnvironment env =

oauth2/core/src/intTest/resources/logback-test.xml

@@ -38,6 +38,10 @@ limitations under the License.
   <logger name="com.dremio.iceberg.authmgr.oauth2.test.container.KeycloakContainer" level="WARN"/>
   <!-- Polaris container logs -->
   <logger name="com.dremio.iceberg.authmgr.oauth2.test.container.PolarisContainer" level="WARN"/>
+  <!-- Hydra container logs -->
+  <logger name="com.dremio.iceberg.authmgr.oauth2.test.container.HydraContainer" level="WARN"/>
+  <!-- Authelia container logs -->
+  <logger name="com.dremio.iceberg.authmgr.oauth2.test.container.AutheliaContainer" level="WARN"/>
   <!-- creates duplicated container logs -->
   <logger name="tc" level="OFF"/>
 </configuration>

oauth2/core/src/testFixtures/java/com/dremio/iceberg/authmgr/oauth2/test/TestEnvironment.java

@@ -655,8 +655,10 @@ public Map<String, String> getHttpConfig() {
         ImmutableMap.<String, String>builder()
             .put(HttpConfig.PREFIX + '.' + HttpConfig.CLIENT_TYPE, getHttpClientType().toString())
             .put(
-                HttpConfig.PREFIX + '.' + HttpConfig.SSL_TRUST_ALL,
-                String.valueOf(isSslTrustAll()));
+                HttpConfig.PREFIX + '.' + HttpConfig.SSL_TRUST_ALL, String.valueOf(isSslTrustAll()))
+            .put(
+                HttpConfig.PREFIX + '.' + HttpConfig.SSL_HOSTNAME_VERIFICATION_ENABLED,
+                String.valueOf(isSslHostnameVerificationEnabled()));
     getSslProtocols()
         .ifPresent(v -> builder.put(HttpConfig.PREFIX + '.' + HttpConfig.SSL_PROTOCOLS, v));
     getSslCipherSuites()
@@ -694,6 +696,11 @@ public boolean isSslTrustAll() {
     return false;
   }
 
+  @Value.Default
+  public boolean isSslHostnameVerificationEnabled() {
+    return true;
+  }
+
   public abstract Optional<String> getProxyHost();
 
   public abstract OptionalInt getProxyPort();

oauth2/core/src/testFixtures/java/com/dremio/iceberg/authmgr/oauth2/test/junit/AutheliaExtension.java

@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2025 Dremio Corporation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.dremio.iceberg.authmgr.oauth2.test.junit;
+
+import com.dremio.iceberg.authmgr.oauth2.http.HttpClientType;
+import com.dremio.iceberg.authmgr.oauth2.test.ImmutableTestEnvironment;
+import com.dremio.iceberg.authmgr.oauth2.test.TestEnvironment;
+import com.dremio.iceberg.authmgr.oauth2.test.TestEnvironmentExtension;
+import com.dremio.iceberg.authmgr.oauth2.test.container.AutheliaContainer;
+import com.nimbusds.oauth2.sdk.Scope;
+import org.junit.jupiter.api.extension.AfterAllCallback;
+import org.junit.jupiter.api.extension.BeforeAllCallback;
+import org.junit.jupiter.api.extension.ExtensionContext;
+
+public class AutheliaExtension extends TestEnvironmentExtension
+    implements BeforeAllCallback, AfterAllCallback {
+
+  // Client1 is used for client_secret_basic authentication
+  public static final String CLIENT_ID1 = "Client1";
+  public static final String CLIENT_SECRET1 = "s3cr3t";
+
+  // Client2 is used for client_secret_post authentication
+  public static final String CLIENT_ID2 = "Client2";
+  public static final String CLIENT_SECRET2 = "s3cr3t";
+
+  // Authelia's private key and certificate
+  // These are classpath resources in the testFixtures resources directory
+  public static final String PRIVATE_KEY = "openssl/rsa_private_key_pkcs8.pem";
+  public static final String CERTIFICATE = "openssl/rsa_certificate.pem";
+
+  @Override
+  public void beforeAll(ExtensionContext context) {
+    AutheliaContainer authelia = new AutheliaContainer(PRIVATE_KEY, CERTIFICATE);
+    authelia.start();
+    context
+        .getStore(ExtensionContext.Namespace.GLOBAL)
+        .put(AutheliaContainer.class.getName(), authelia);
+  }
+
+  @Override
+  public void afterAll(ExtensionContext context) {
+    AutheliaContainer authelia =
+        context
+            .getStore(ExtensionContext.Namespace.GLOBAL)
+            .remove(AutheliaContainer.class.getName(), AutheliaContainer.class);
+    if (authelia != null) {
+      authelia.close();
+    }
+  }
+
+  @Override
+  protected ImmutableTestEnvironment.Builder newTestEnvironmentBuilder(ExtensionContext context) {
+    AutheliaContainer authelia =
+        context
+            .getStore(ExtensionContext.Namespace.GLOBAL)
+            .get(AutheliaContainer.class.getName(), AutheliaContainer.class);
+    return TestEnvironment.builder()
+        .unitTest(false)
+        .discoveryEnabled(true)
+        .sslTrustAll(true)
+        .sslHostnameVerificationEnabled(false)
+        .httpClientType(HttpClientType.APACHE) // required for SSL
+        .serverRootUrl(authelia.getAutheliaUrl())
+        .authorizationServerUrl(authelia.getAutheliaUrl())
+        .scope(Scope.parse("profile"));
+  }
+}