Allow openid for integration tests

Author: oysand

src/isar/apis/security/authentication.py

@@ -4,6 +4,7 @@
 from fastapi import Depends
 from fastapi.security.base import SecurityBase
 from fastapi_azure_auth import SingleTenantAzureAuthorizationCodeBearer
+from fastapi_azure_auth.auth import AzureAuthorizationCodeBearerBase
 from fastapi_azure_auth.exceptions import InvalidAuthHttp
 from fastapi_azure_auth.user import User
 from pydantic import BaseModel
@@ -21,13 +22,47 @@ def __init__(self) -> None:
         self.scheme_name = "No Security"
 
 
-azure_scheme = SingleTenantAzureAuthorizationCodeBearer(
-    app_client_id=settings.AZURE_CLIENT_ID,
-    tenant_id=settings.AZURE_TENANT_ID,
-    scopes={
+def build_azure_scheme() -> AzureAuthorizationCodeBearerBase:
+    """
+    Build the security scheme used to validate access tokens.
+
+    By default this is a single tenant Azure Entra ID scheme. If
+    ``settings.OPENID_CONFIG_URL`` is set, the OpenID Connect discovery document is
+    read from that URL instead, which allows ISAR to be pointed at a different
+    OpenID provider such as a local mock issuer used by the integration tests.
+
+    ``SingleTenantAzureAuthorizationCodeBearer`` does not accept an
+    ``openid_config_url`` argument, so the base class is used directly in that case.
+    Issuer validation remains enabled either way; the expected issuer is taken from
+    the discovery document.
+
+    Returns
+    -------
+    AzureAuthorizationCodeBearerBase
+        The configured security scheme.
+    """
+    scopes: dict[str, str] = {
         f"api://{settings.AZURE_CLIENT_ID}/user_impersonation": "user_impersonation",
-    },
-)
+    }
+
+    if settings.OPENID_CONFIG_URL:
+        return AzureAuthorizationCodeBearerBase(
+            app_client_id=settings.AZURE_CLIENT_ID,
+            tenant_id=settings.AZURE_TENANT_ID,
+            scopes=scopes,
+            openid_config_url=settings.OPENID_CONFIG_URL,
+            openapi_authorization_url=settings.OPENAPI_AUTHORIZATION_URL,
+            openapi_token_url=settings.OPENAPI_TOKEN_URL,
+        )
+
+    return SingleTenantAzureAuthorizationCodeBearer(
+        app_client_id=settings.AZURE_CLIENT_ID,
+        tenant_id=settings.AZURE_TENANT_ID,
+        scopes=scopes,
+    )
+
+
+azure_scheme: AzureAuthorizationCodeBearerBase = build_azure_scheme()
 
 
 async def validate_has_role(user: User = Depends(azure_scheme)) -> None:

src/isar/config/settings.py

@@ -125,6 +125,19 @@ class Settings(BaseSettings):
     # ChainedTokenCredential (e.g. "WorkloadIdentity,ClientSecret").
     ALLOWED_AUTH_METHODS: str = Field(default="ClientSecret")
 
+    # Override the OpenID Connect discovery document URL used to validate access
+    # tokens. When unset (the default), the URL is derived from AZURE_TENANT_ID and
+    # points at Azure Entra ID. Set this to point ISAR at a different OpenID
+    # provider, such as a local mock issuer used by the integration tests.
+    OPENID_CONFIG_URL: str | None = Field(default=None)
+
+    # Override the authorization and token URLs advertised in the generated OpenAPI
+    # document, so that Swagger's "Authorize" button does not point at
+    # login.microsoftonline.com when a non-Azure issuer is configured. Only affect
+    # the API documentation; token validation is governed by OPENID_CONFIG_URL.
+    OPENAPI_AUTHORIZATION_URL: str | None = Field(default=None)
+    OPENAPI_TOKEN_URL: str | None = Field(default=None)
+
     # MQTT username
     # The username and password is set by the MQTT broker and must be known in advance
     # The password should be set as an environment variable "MQTT_PASSWORD"

tests/isar/apis/security/test_authentication.py

@@ -3,6 +3,12 @@
 import jwt
 import pytest
 from fastapi.testclient import TestClient
+from fastapi_azure_auth import SingleTenantAzureAuthorizationCodeBearer
+from fastapi_azure_auth.auth import AzureAuthorizationCodeBearerBase
+from pytest import MonkeyPatch
+
+from isar.apis.security.authentication import build_azure_scheme
+from isar.config.settings import settings
 
 
 def stub_access_token() -> str:
@@ -30,3 +36,55 @@ def test_authentication(
         )
 
         assert response.status_code == expected_status_code
+
+
+class TestBuildAzureScheme:
+    def test_defaults_to_single_tenant_azure_scheme(
+        self, monkeypatch: MonkeyPatch
+    ) -> None:
+        monkeypatch.setattr(settings, "OPENID_CONFIG_URL", None)
+
+        scheme = build_azure_scheme()
+
+        assert isinstance(scheme, SingleTenantAzureAuthorizationCodeBearer)
+        # No override, so the discovery document URL is derived from the tenant ID
+        # and points at Azure Entra ID.
+        assert scheme.openid_config.config_url is None
+        assert scheme.openid_config.tenant_id == settings.AZURE_TENANT_ID
+        assert scheme.app_client_id == settings.AZURE_CLIENT_ID
+
+    def test_openid_config_url_is_honoured(self, monkeypatch: MonkeyPatch) -> None:
+        config_url = "http://oauth-mock:8080/.well-known/openid-configuration"
+        authorization_url = "http://oauth-mock:8080/authorize"
+        token_url = "http://oauth-mock:8080/token"
+
+        monkeypatch.setattr(settings, "OPENID_CONFIG_URL", config_url)
+        monkeypatch.setattr(settings, "OPENAPI_AUTHORIZATION_URL", authorization_url)
+        monkeypatch.setattr(settings, "OPENAPI_TOKEN_URL", token_url)
+
+        scheme = build_azure_scheme()
+
+        assert not isinstance(scheme, SingleTenantAzureAuthorizationCodeBearer)
+        assert isinstance(scheme, AzureAuthorizationCodeBearerBase)
+        assert scheme.openid_config.config_url == config_url
+        assert scheme.authorization_url == authorization_url
+        assert scheme.token_url == token_url
+        # The audience is still ISAR's own client ID, and issuer validation stays on.
+        assert scheme.app_client_id == settings.AZURE_CLIENT_ID
+        assert scheme.validate_iss is True
+
+    def test_openapi_urls_fall_back_to_azure_when_unset(
+        self, monkeypatch: MonkeyPatch
+    ) -> None:
+        monkeypatch.setattr(
+            settings,
+            "OPENID_CONFIG_URL",
+            "http://oauth-mock:8080/.well-known/openid-configuration",
+        )
+        monkeypatch.setattr(settings, "OPENAPI_AUTHORIZATION_URL", None)
+        monkeypatch.setattr(settings, "OPENAPI_TOKEN_URL", None)
+
+        scheme = build_azure_scheme()
+
+        assert scheme.authorization_url is not None
+        assert settings.AZURE_TENANT_ID in scheme.authorization_url