Skip to content

Commit 483f8d7

Browse files
mjurcjedla97
mjurc
authored and
jedla97
committed
Make OpenShiftMetaEndpointIT use RHBK on OCP
* Just like all the other OCP tests using KC. For this, we need to extract the test logic into abstract parent also
1 parent 9eb47e7 commit 483f8d7

File tree

3 files changed

+137
-115
lines changed

3 files changed

+137
-115
lines changed

‎security/keycloak/src/test/java/io/quarkus/ts/security/keycloak/AbstractMetaEndpointIT.java‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
package io.quarkus.ts.security.keycloak;
2+
3+
import static org.junit.jupiter.api.Assertions.assertEquals;
4+
5+
import org.apache.http.HttpStatus;
6+
import org.junit.jupiter.api.Assertions;
7+
import org.junit.jupiter.api.MethodOrderer;
8+
import org.junit.jupiter.api.Order;
9+
import org.junit.jupiter.api.Test;
10+
import org.junit.jupiter.api.TestMethodOrder;
11+
12+
import io.quarkus.test.bootstrap.KeycloakService;
13+
import io.quarkus.test.bootstrap.LookupService;
14+
import io.quarkus.test.bootstrap.Protocol;
15+
import io.quarkus.test.bootstrap.RestService;
16+
import io.quarkus.test.services.Certificate;
17+
import io.quarkus.test.services.QuarkusApplication;
18+
import io.quarkus.test.services.URILike;
19+
import io.restassured.path.json.JsonPath;
20+
import io.restassured.response.Response;
21+
22+
@TestMethodOrder(MethodOrderer.OrderAnnotation.class)
23+
public abstract class AbstractMetaEndpointIT {
24+
25+
@LookupService
26+
static KeycloakService keycloak;
27+
static final String CUSTOM_ENDPOINT = "/custom-endpoint";
28+
private static final String DEFAULT_META_ENDPOINT = ".well-known/oauth-protected-resource";
29+
static final String OVERLOADED_META_ENDPOINT = "/" + DEFAULT_META_ENDPOINT + CUSTOM_ENDPOINT;
30+
31+
@QuarkusApplication
32+
static RestService http = new RestService()
33+
.withProperty("quarkus.oidc.auth-server-url", () -> keycloak.getRealmUrl())
34+
.withProperty("quarkus.oidc.resource-metadata.enabled", "true")
35+
.withProperty("quarkus.oidc.client-id", BaseOidcSecurityIT.CLIENT_ID_DEFAULT)
36+
.withProperty("quarkus.oidc.credentials.secret", BaseOidcSecurityIT.CLIENT_SECRET_DEFAULT)
37+
.withProperties(() -> keycloak.getTlsProperties());
38+
39+
@QuarkusApplication(ssl = true, certificates = @Certificate(configureKeystore = true, configureTruststore = true, configureHttpServer = true))
40+
static RestService https = new RestService()
41+
.withProperty("quarkus.oidc.auth-server-url", () -> keycloak.getRealmUrl())
42+
.withProperty("quarkus.oidc.resource-metadata.enabled", "true")
43+
.withProperty("quarkus.http.ssl.client-auth", "request")
44+
.withProperty("quarkus.http.auth.permission.auth.policy", "authenticated")
45+
.withProperty("quarkus.http.auth.permission.auth.paths", "/user")
46+
.withProperty("quarkus.oidc.resource-metadata.resource", CUSTOM_ENDPOINT)
47+
.withProperty("quarkus.oidc.client-id", BaseOidcSecurityIT.CLIENT_ID_DEFAULT)
48+
.withProperty("quarkus.oidc.credentials.secret", BaseOidcSecurityIT.CLIENT_SECRET_DEFAULT)
49+
.withProperties(() -> keycloak.getTlsProperties());
50+
51+
@Test
52+
@Order(1)
53+
public void httpHasHTTPSMetadata() {
54+
Response response = http.given()
55+
.when()
56+
.get(DEFAULT_META_ENDPOINT);
57+
assertEquals(HttpStatus.SC_OK, response.statusCode());
58+
JsonPath jsonPath = response.body().jsonPath();
59+
assertEquals(getAppURL(http, Protocol.HTTP).withScheme("https").toString(),
60+
jsonPath.getString("resource"),
61+
"No app URL in the body: " + response.body().asString());
62+
assertEquals(keycloak.getRealmUrl(),
63+
jsonPath.getString("authorization_servers[0]"),
64+
"No authorization server URL in the body: " + response.body().asString());
65+
}
66+
67+
@Test
68+
@Order(2)
69+
public void noForcedHttps() {
70+
http.stop();
71+
http.withProperty("quarkus.oidc.resource-metadata.force-https-scheme", "false");
72+
http.start();
73+
Response response = http.given()
74+
.when()
75+
.get(DEFAULT_META_ENDPOINT);
76+
assertEquals(HttpStatus.SC_OK, response.statusCode());
77+
JsonPath jsonPath = response.body().jsonPath();
78+
assertEquals(getAppURL(http, Protocol.HTTP).toString(),
79+
jsonPath.getString("resource"),
80+
"No app URL in the body: " + response.body().asString());
81+
assertEquals(keycloak.getRealmUrl(),
82+
jsonPath.getString("authorization_servers[0]"),
83+
"No authorization server URL in the body: " + response.body().asString());
84+
}
85+
86+
@Test
87+
public void endpointInfoInHeader() {
88+
Response response = https
89+
.relaxedHttps()
90+
.given()
91+
.when()
92+
.get("/user");
93+
assertEquals(HttpStatus.SC_UNAUTHORIZED, response.statusCode());
94+
String header = response.header("www-authenticate");
95+
Assertions.assertNotNull(header, "There is no authentication header in the answer!");
96+
String metadataURL = getAppURL(https, Protocol.HTTPS)
97+
.withPath(OVERLOADED_META_ENDPOINT)
98+
.toString();
99+
// What value of the 'www-authenticate' header looks like:
100+
// Bearer resource_metadata="https://localhost:1103/.well-known/oauth-protected-resource/custom-endpoint"
101+
assertEquals(metadataURL,
102+
header.split("=")[1].replaceAll("\"", ""),
103+
"Authentication header doesn't contain metadata endpoint");
104+
}
105+
106+
URILike getAppURL(RestService app, Protocol protocol) {
107+
return app.getURI(protocol);
108+
}
109+
110+
@Test
111+
public void httpsHasMetadata() {
112+
Response response = https
113+
.relaxedHttps()
114+
.given()
115+
.when()
116+
.get(OVERLOADED_META_ENDPOINT);
117+
JsonPath jsonPath = response.body().jsonPath();
118+
assertEquals(getAppURL(https, Protocol.HTTPS).withPath(CUSTOM_ENDPOINT).toString(),
119+
jsonPath.getString("resource"),
120+
"No app URL in the body: " + response.body().asString());
121+
assertEquals(keycloak.getRealmUrl(),
122+
jsonPath.getString("authorization_servers[0]"),
123+
"No authorization server URL in the body: " + response.body().asString());
124+
}
125+
}

‎security/keycloak/src/test/java/io/quarkus/ts/security/keycloak/MetaEndpointIT.java‎

Lines changed: 1 addition & 114 deletions
Original file line numberDiff line numberDiff line change
@@ -3,128 +3,15 @@
33
import static io.quarkus.test.bootstrap.KeycloakService.DEFAULT_REALM;
44
import static io.quarkus.test.bootstrap.KeycloakService.DEFAULT_REALM_BASE_PATH;
55
import static io.quarkus.test.bootstrap.KeycloakService.DEFAULT_REALM_FILE;
6-
import static org.junit.jupiter.api.Assertions.assertEquals;
7-
8-
import org.apache.http.HttpStatus;
9-
import org.junit.jupiter.api.Assertions;
10-
import org.junit.jupiter.api.MethodOrderer;
11-
import org.junit.jupiter.api.Order;
12-
import org.junit.jupiter.api.Test;
13-
import org.junit.jupiter.api.TestMethodOrder;
146

157
import io.quarkus.test.bootstrap.KeycloakService;
16-
import io.quarkus.test.bootstrap.Protocol;
17-
import io.quarkus.test.bootstrap.RestService;
188
import io.quarkus.test.scenarios.QuarkusScenario;
19-
import io.quarkus.test.services.Certificate;
209
import io.quarkus.test.services.KeycloakContainer;
21-
import io.quarkus.test.services.QuarkusApplication;
22-
import io.quarkus.test.services.URILike;
23-
import io.restassured.path.json.JsonPath;
24-
import io.restassured.response.Response;
2510

2611
@QuarkusScenario
27-
@TestMethodOrder(MethodOrderer.OrderAnnotation.class)
28-
public class MetaEndpointIT {
12+
public class MetaEndpointIT extends AbstractMetaEndpointIT {
2913

3014
@KeycloakContainer(runKeycloakInProdMode = true)
3115
static KeycloakService keycloak = new KeycloakService(DEFAULT_REALM_FILE, DEFAULT_REALM, DEFAULT_REALM_BASE_PATH);
32-
static final String CUSTOM_ENDPOINT = "/custom-endpoint";
33-
private static final String DEFAULT_META_ENDPOINT = ".well-known/oauth-protected-resource";
34-
static final String OVERLOADED_META_ENDPOINT = "/" + DEFAULT_META_ENDPOINT + CUSTOM_ENDPOINT;
35-
36-
@QuarkusApplication
37-
static RestService http = new RestService()
38-
.withProperty("quarkus.oidc.auth-server-url", () -> keycloak.getRealmUrl())
39-
.withProperty("quarkus.oidc.resource-metadata.enabled", "true")
40-
.withProperty("quarkus.oidc.client-id", BaseOidcSecurityIT.CLIENT_ID_DEFAULT)
41-
.withProperty("quarkus.oidc.credentials.secret", BaseOidcSecurityIT.CLIENT_SECRET_DEFAULT)
42-
.withProperties(keycloak::getTlsProperties);
43-
44-
@QuarkusApplication(ssl = true, certificates = @Certificate(configureKeystore = true, configureTruststore = true, configureHttpServer = true))
45-
static RestService https = new RestService()
46-
.withProperty("quarkus.oidc.auth-server-url", () -> keycloak.getRealmUrl())
47-
.withProperty("quarkus.oidc.resource-metadata.enabled", "true")
48-
.withProperty("quarkus.http.ssl.client-auth", "request")
49-
.withProperty("quarkus.http.auth.permission.auth.policy", "authenticated")
50-
.withProperty("quarkus.http.auth.permission.auth.paths", "/user")
51-
.withProperty("quarkus.oidc.resource-metadata.resource", CUSTOM_ENDPOINT)
52-
.withProperty("quarkus.oidc.client-id", BaseOidcSecurityIT.CLIENT_ID_DEFAULT)
53-
.withProperty("quarkus.oidc.credentials.secret", BaseOidcSecurityIT.CLIENT_SECRET_DEFAULT)
54-
.withProperties(keycloak::getTlsProperties);
55-
56-
@Test
57-
@Order(1)
58-
public void httpHasHTTPSMetadata() {
59-
Response response = http.given()
60-
.when()
61-
.get(DEFAULT_META_ENDPOINT);
62-
assertEquals(HttpStatus.SC_OK, response.statusCode());
63-
JsonPath jsonPath = response.body().jsonPath();
64-
assertEquals(getAppURL(http, Protocol.HTTP).withScheme("https").toString(),
65-
jsonPath.getString("resource"),
66-
"No app URL in the body: " + response.body().asString());
67-
assertEquals(keycloak.getRealmUrl(),
68-
jsonPath.getString("authorization_servers[0]"),
69-
"No authorization server URL in the body: " + response.body().asString());
70-
}
71-
72-
@Test
73-
@Order(2)
74-
public void noForcedHttps() {
75-
http.stop();
76-
http.withProperty("quarkus.oidc.resource-metadata.force-https-scheme", "false");
77-
http.start();
78-
Response response = http.given()
79-
.when()
80-
.get(DEFAULT_META_ENDPOINT);
81-
assertEquals(HttpStatus.SC_OK, response.statusCode());
82-
JsonPath jsonPath = response.body().jsonPath();
83-
assertEquals(getAppURL(http, Protocol.HTTP).toString(),
84-
jsonPath.getString("resource"),
85-
"No app URL in the body: " + response.body().asString());
86-
assertEquals(keycloak.getRealmUrl(),
87-
jsonPath.getString("authorization_servers[0]"),
88-
"No authorization server URL in the body: " + response.body().asString());
89-
}
90-
91-
@Test
92-
public void endpointInfoInHeader() {
93-
Response response = https
94-
.relaxedHttps()
95-
.given()
96-
.when()
97-
.get("/user");
98-
assertEquals(HttpStatus.SC_UNAUTHORIZED, response.statusCode());
99-
String header = response.header("www-authenticate");
100-
Assertions.assertNotNull(header, "There is no authentication header in the answer!");
101-
String metadataURL = getAppURL(https, Protocol.HTTPS)
102-
.withPath(OVERLOADED_META_ENDPOINT)
103-
.toString();
104-
// What value of the 'www-authenticate' header looks like:
105-
// Bearer resource_metadata="https://localhost:1103/.well-known/oauth-protected-resource/custom-endpoint"
106-
assertEquals(metadataURL,
107-
header.split("=")[1].replaceAll("\"", ""),
108-
"Authentication header doesn't contain metadata endpoint");
109-
}
110-
111-
URILike getAppURL(RestService app, Protocol protocol) {
112-
return app.getURI(protocol);
113-
}
11416

115-
@Test
116-
public void httpsHasMetadata() {
117-
Response response = https
118-
.relaxedHttps()
119-
.given()
120-
.when()
121-
.get(OVERLOADED_META_ENDPOINT);
122-
JsonPath jsonPath = response.body().jsonPath();
123-
assertEquals(getAppURL(https, Protocol.HTTPS).withPath(CUSTOM_ENDPOINT).toString(),
124-
jsonPath.getString("resource"),
125-
"No app URL in the body: " + response.body().asString());
126-
assertEquals(keycloak.getRealmUrl(),
127-
jsonPath.getString("authorization_servers[0]"),
128-
"No authorization server URL in the body: " + response.body().asString());
129-
}
13017
}

‎security/keycloak/src/test/java/io/quarkus/ts/security/keycloak/OpenShiftMetaEndpointIT.java‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,22 @@
11
package io.quarkus.ts.security.keycloak;
22

3+
import static io.quarkus.test.bootstrap.KeycloakService.DEFAULT_REALM;
4+
import static io.quarkus.test.bootstrap.KeycloakService.DEFAULT_REALM_BASE_PATH;
5+
import static io.quarkus.test.bootstrap.KeycloakService.DEFAULT_REALM_FILE;
6+
7+
import io.quarkus.test.bootstrap.KeycloakService;
38
import io.quarkus.test.bootstrap.Protocol;
49
import io.quarkus.test.bootstrap.RestService;
510
import io.quarkus.test.scenarios.OpenShiftScenario;
11+
import io.quarkus.test.services.KeycloakContainer;
612
import io.quarkus.test.services.URILike;
713

814
@OpenShiftScenario
9-
public class OpenShiftMetaEndpointIT extends MetaEndpointIT {
15+
public class OpenShiftMetaEndpointIT extends AbstractMetaEndpointIT {
16+
17+
@KeycloakContainer(runKeycloakInProdMode = true, image = "${rhbk.image}")
18+
static KeycloakService keycloak = new KeycloakService(DEFAULT_REALM_FILE, DEFAULT_REALM, DEFAULT_REALM_BASE_PATH);
19+
1020
@Override
1121
URILike getAppURL(RestService app, Protocol protocol) {
1222
// For some reason, when running on OpenStack, the URI contains port number,

0 commit comments

Comments
 (0)