Add OIDC authentication to integration tests

Deploys Dex (OIDC provider) and GLAuth (LDAP) alongside CTS in the
EaaS pipeline and exercises the full mod_auth_openidc → load_openidc_user
→ get_user_info → query_ldap_groups → has_role auth stack end-to-end.

Pipeline changes (.tekton/integration-test-eaas.yaml):
- New deploy-glauth task (parallel with deploy-dex, after
  provision-environment): creates a ConfigMap with a GLAuth config
  defining two users (builder/readonly) and one group (cts-builders),
  then deploys GLAuth on port 3893.
- New deploy-dex task (parallel with deploy-glauth): creates a ConfigMap
  with a Dex config using the password connector and a static OAuth2
  client (cts-integration), then deploys Dex on port 5556.
- Updated deploy-cts: runAfter now includes deploy-glauth and deploy-dex.
  The cts-config ConfigMap sets AUTH_BACKEND=openidc,
  AUTH_OPENIDC_USERINFO_URI, AUTH_LDAP_SERVER, AUTH_LDAP_GROUPS, ADMINS,
  and ALLOWED_BUILDERS.  The httpd.conf uses AuthType openid-connect with
  OIDCProviderMetadataURL pointing at Dex's discovery document.
  OIDCSSLValidateServer Off and OIDCOAuthSSLValidateServer Off permit
  the HTTP-only Dex endpoint.  Bearer token validation uses
  OIDCOAuthVerifyJwksUri pointing at Dex's JWKS endpoint (http://dex:5556/keys),
  which validates tokens as JWTs locally and populates OIDC_access_token
  and OIDC_CLAIM_* in the WSGI environ — variables required by
  load_openidc_user.  The <RequireAny> block allows unauthenticated GET
  requests while requiring a valid Bearer token for writes.
- Updated run-tests: installs requests alongside pytest and passes
  AUTH_BACKEND=openidc so the auth tests are not skipped.

Test changes (tests/test_integration_api.py):
- AuthHTTPClient: HTTPClient subclass that injects Authorization: Bearer
  on every request.
- _get_oidc_token(): obtains a real access token from Dex via the ROPC
  grant.
- write_http_client fixture: returns an AuthHTTPClient (builder token)
  under OIDC or a plain HTTPClient in noauth mode; used by the five
  pre-existing workflow tests so they continue to pass in both modes.
- Four new test functions (skipped when AUTH_BACKEND != openidc):
  test_auth_unauthenticated_write_returns_401,
  test_auth_builder_can_post_compose,
  test_auth_unauthorized_user_returns_403,
  test_auth_get_endpoints_accessible_without_token.

Generated-By: OpenCode (google-vertex-anthropic/claude-sonnet-4-6@default)

Author: Agent

.tekton/integration-test-eaas.yaml

@@ -77,6 +77,293 @@ spec:
     - name: ownerUid
       value: $(context.pipelineRun.uid)
 
+  - name: deploy-glauth
+    runAfter:
+    - provision-environment
+    taskSpec:
+      params:
+      - name: kubeconfig-secret
+        type: string
+      steps:
+      - name: create-glauth
+        image: quay.io/konflux-ci/appstudio-utils:latest
+        script: |
+          #!/usr/bin/env bash
+          set -euo pipefail
+
+          KUBECONFIG=/tmp/kubeconfig
+          kubectl get secret $(params.kubeconfig-secret) -o jsonpath='{.data.kubeconfig}' | base64 -d > $KUBECONFIG
+          export KUBECONFIG
+
+          echo "=========================================="
+          echo "Deploying GLAuth LDAP Server"
+          echo "=========================================="
+
+          kubectl apply -f - <<'EOFYAML'
+          apiVersion: v1
+          kind: ConfigMap
+          metadata:
+            name: glauth-config
+          data:
+            glauth.cfg: |
+              [ldap]
+                enabled = true
+                listen = "0.0.0.0:3893"
+
+              [ldaps]
+                enabled = false
+
+              [backend]
+                datastore = "config"
+                baseDN = "dc=example,dc=com"
+
+              [[users]]
+                name = "builder"
+                unixid = 5001
+                primarygroup = 5501
+                passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a"
+                [[users.capabilities]]
+                  action = "search"
+                  object = "*"
+
+              [[users]]
+                name = "readonly"
+                unixid = 5002
+                primarygroup = 5502
+                passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a"
+                [[users.capabilities]]
+                  action = "search"
+                  object = "*"
+
+              [[groups]]
+                name = "cts-builders"
+                unixid = 5501
+                includegroups = []
+
+              [[groups]]
+                name = "readonly-users"
+                unixid = 5502
+                includegroups = []
+          EOFYAML
+
+          kubectl apply -f - <<'EOFYAML'
+          apiVersion: apps/v1
+          kind: Deployment
+          metadata:
+            name: glauth
+            labels:
+              app: glauth
+          spec:
+            replicas: 1
+            selector:
+              matchLabels:
+                app: glauth
+            template:
+              metadata:
+                labels:
+                  app: glauth
+              spec:
+                containers:
+                - name: glauth
+                  image: docker.io/glauth/glauth:v2.3.2
+                  command: ["/app/glauth"]
+                  args: ["-c", "/etc/glauth/glauth.cfg"]
+                  ports:
+                  - containerPort: 3893
+                    name: ldap
+                  readinessProbe:
+                    tcpSocket:
+                      port: 3893
+                    initialDelaySeconds: 3
+                    periodSeconds: 5
+                    failureThreshold: 12
+                  resources:
+                    requests:
+                      memory: "64Mi"
+                      cpu: "50m"
+                    limits:
+                      memory: "128Mi"
+                      cpu: "200m"
+                  volumeMounts:
+                  - name: glauth-config
+                    mountPath: /etc/glauth
+                    readOnly: true
+                volumes:
+                - name: glauth-config
+                  configMap:
+                    name: glauth-config
+          ---
+          apiVersion: v1
+          kind: Service
+          metadata:
+            name: glauth
+            labels:
+              app: glauth
+          spec:
+            ports:
+            - port: 3893
+              targetPort: 3893
+              name: ldap
+            selector:
+              app: glauth
+          EOFYAML
+
+          echo "Waiting for GLAuth to be ready..."
+          if ! kubectl wait --for=condition=available --timeout=120s deployment/glauth; then
+            echo "GLAuth deployment failed! Debug info:"
+            kubectl describe deployment glauth
+            kubectl describe pod -l app=glauth
+            kubectl logs -l app=glauth --tail=50 || echo "No logs available"
+            exit 1
+          fi
+          echo "✓ GLAuth is ready"
+    params:
+    - name: kubeconfig-secret
+      value: $(tasks.provision-environment.results.secretRef)
+
+  - name: deploy-dex
+    runAfter:
+    - provision-environment
+    taskSpec:
+      params:
+      - name: kubeconfig-secret
+        type: string
+      steps:
+      - name: create-dex
+        image: quay.io/konflux-ci/appstudio-utils:latest
+        script: |
+          #!/usr/bin/env bash
+          set -euo pipefail
+
+          KUBECONFIG=/tmp/kubeconfig
+          kubectl get secret $(params.kubeconfig-secret) -o jsonpath='{.data.kubeconfig}' | base64 -d > $KUBECONFIG
+          export KUBECONFIG
+
+          echo "=========================================="
+          echo "Deploying Dex OIDC Provider"
+          echo "=========================================="
+
+          kubectl apply -f - <<'EOFYAML'
+          apiVersion: v1
+          kind: ConfigMap
+          metadata:
+            name: dex-config
+          data:
+            config.yaml: |
+              issuer: http://dex:5556
+
+              storage:
+                type: memory
+
+              web:
+                http: 0.0.0.0:5556
+
+              logger:
+                level: debug
+
+              enablePasswordDB: true
+
+              staticPasswords:
+              - email: builder@example.com
+                hash: "$2y$10$6cZyh42YBb2Q5.fE9nj3mu3UHs21NUmVP2fpU63EM3/ecJuHVscEC"
+                username: builder
+                userID: "builder-id"
+              - email: readonly@example.com
+                hash: "$2y$10$6cZyh42YBb2Q5.fE9nj3mu3UHs21NUmVP2fpU63EM3/ecJuHVscEC"
+                username: readonly
+                userID: "readonly-id"
+
+              staticClients:
+              - id: cts-integration
+                secret: cts-integration-secret
+                name: CTS Integration
+                redirectURIs:
+                - http://cts:8080/redirect_uri
+                grantTypes:
+                - password
+                - authorization_code
+
+              oauth2:
+                skipApprovalScreen: true
+                passwordConnector: local
+          EOFYAML
+
+          kubectl apply -f - <<'EOFYAML'
+          apiVersion: apps/v1
+          kind: Deployment
+          metadata:
+            name: dex
+            labels:
+              app: dex
+          spec:
+            replicas: 1
+            selector:
+              matchLabels:
+                app: dex
+            template:
+              metadata:
+                labels:
+                  app: dex
+              spec:
+                containers:
+                - name: dex
+                  image: ghcr.io/dexidp/dex:v2.41.1
+                  args: ["dex", "serve", "/etc/dex/config.yaml"]
+                  ports:
+                  - containerPort: 5556
+                    name: http
+                  resources:
+                    requests:
+                      memory: "64Mi"
+                      cpu: "50m"
+                    limits:
+                      memory: "256Mi"
+                      cpu: "500m"
+                  readinessProbe:
+                    httpGet:
+                      path: /.well-known/openid-configuration
+                      port: 5556
+                    initialDelaySeconds: 5
+                    periodSeconds: 5
+                    timeoutSeconds: 5
+                    failureThreshold: 12
+                  volumeMounts:
+                  - name: dex-config
+                    mountPath: /etc/dex
+                    readOnly: true
+                volumes:
+                - name: dex-config
+                  configMap:
+                    name: dex-config
+          ---
+          apiVersion: v1
+          kind: Service
+          metadata:
+            name: dex
+            labels:
+              app: dex
+          spec:
+            ports:
+            - port: 5556
+              targetPort: 5556
+              name: http
+            selector:
+              app: dex
+          EOFYAML
+
+          echo "Waiting for Dex to be ready..."
+          if ! kubectl wait --for=condition=available --timeout=180s deployment/dex; then
+            echo "Dex deployment failed! Debug info:"
+            kubectl describe deployment dex
+            kubectl describe pod -l app=dex
+            kubectl logs -l app=dex --tail=50 || echo "No logs available"
+            exit 1
+          fi
+          echo "✓ Dex is ready"
+    params:
+    - name: kubeconfig-secret
+      value: $(tasks.provision-environment.results.secretRef)
+
   - name: deploy-database
     runAfter:
     - provision-environment
@@ -215,6 +502,8 @@ spec:
   - name: deploy-cts
     runAfter:
     - deploy-database
+    - deploy-glauth
+    - deploy-dex
     taskSpec:
       params:
       - name: kubeconfig-secret
@@ -241,7 +530,7 @@ spec:
           echo "Image: $IMAGE"
 
           # Create ConfigMap with production configuration and httpd config for CTS
-          kubectl apply -f - <<EOF
+          kubectl apply -f - <<'EOFYAML'
           apiVersion: v1
           kind: ConfigMap
           metadata:
@@ -251,8 +540,16 @@ spec:
               from conf.config import BaseConfiguration
 
               class ProdConfiguration(BaseConfiguration):
-                  AUTH_BACKEND = "noauth"
+                  AUTH_BACKEND = "openidc"
                   SQLALCHEMY_DATABASE_URI = "postgresql://cts:cts-test@cts-db:5432/cts"
+                  AUTH_OPENIDC_USERINFO_URI = "http://dex:5556/userinfo"
+                  AUTH_OPENIDC_REQUIRED_SCOPES = ["openid"]
+                  AUTH_LDAP_SERVER = "ldap://glauth:3893"
+                  AUTH_LDAP_GROUPS = [
+                      ("ou=groups,dc=example,dc=com", "(&(objectClass=posixGroup)(memberUid={0}))"),
+                  ]
+                  ADMINS = {"groups": [], "users": ["builder"]}
+                  ALLOWED_BUILDERS = {"groups": [], "users": ["builder"]}
             httpd.conf: |
               ServerRoot "/etc/httpd"
               PidFile /tmp/httpd.pid
@@ -268,15 +565,33 @@ spec:
 
               Include conf.modules.d/*.conf
 
+              OIDCProviderMetadataURL http://dex:5556/.well-known/openid-configuration
+              OIDCSSLValidateServer Off
+              OIDCClientID cts-integration
+              OIDCClientSecret cts-integration-secret
+              OIDCRedirectURI http://cts:8080/redirect_uri
+              OIDCCryptoPassphrase changeme
+              OIDCRemoteUserClaim preferred_username
+              OIDCOAuthVerifyJwksUri http://dex:5556/keys
+              OIDCOAuthSSLValidateServer Off
+
               WSGISocketPrefix /tmp/wsgi
               WSGIDaemonProcess cts threads=5 home=/usr/share/cts
               WSGIScriptAlias / /usr/share/cts/cts.wsgi
 
               <Directory /usr/share/cts>
                   WSGIProcessGroup cts
                   WSGIApplicationGroup %{GLOBAL}
+                  AuthType openid-connect
+                  <RequireAny>
+                      <RequireAll>
+                          Require expr %{REQUEST_URI} !~ /userinfo/
+                          Require method GET
+                      </RequireAll>
+                      Require valid-user
+                  </RequireAny>
               </Directory>
-          EOF
+          EOFYAML
 
           # Deploy CTS
           kubectl apply -f - <<EOF
@@ -478,9 +793,9 @@ spec:
             set -ex
             export HOME=/tmp
 
-            echo 'Installing pytest...'
+            echo 'Installing pytest and requests...'
             python3 -m ensurepip
-            python3 -m pip install --user pytest
+            python3 -m pip install --user pytest requests
 
             echo ''
             echo 'Cloning repository...'
@@ -492,7 +807,7 @@ spec:
 
             echo ''
             echo 'Running pytest...'
-            CTS_URL=http://cts:8080 python3 -m pytest tests/test_integration_api.py -v -s -o addopts=
+            CTS_URL=http://cts:8080 AUTH_BACKEND=openidc python3 -m pytest tests/test_integration_api.py -v -s -o addopts=
           "
           TEST_RESULT=$?
           set -e