Skip to content

Commit 286df9a

Browse files
d34dh0r53d34dh0r53
committed
Update test
1 parent 4f41cd6 commit 286df9a

File tree

3 files changed

+113
-94
lines changed

3 files changed

+113
-94
lines changed

‎templates/keystoneapi/config/httpd.conf‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -51,16 +51,14 @@ CustomLog /dev/stdout proxy env=forwarded
5151
SSLCertificateKeyFile "{{ $vhost.SSLCertificateKeyFile }}"
5252
{{- end }}
5353

54-
## WSGI configuration
54+
## WSGI configuration
5555
WSGIApplicationGroup %{GLOBAL}
5656
WSGIDaemonProcess {{ $endpt }} display-name={{ $endpt }} group=keystone processes={{ $.ProcessNumber }} threads=1 user=keystone
5757
WSGIProcessGroup {{ $endpt }}
5858
WSGIScriptAlias / "/usr/bin/keystone-wsgi-public"
5959
WSGIPassAuthorization On
6060

61-
62-
{{- if $vhost.EnableFederation }}
63-
# LoadModule auth_openidc_module modules/mod_auth_openidc.so
61+
{{ if $vhost.EnableFederation }}
6462
OIDCClaimPrefix "{{ $vhost.OIDCClaimPrefix }}"
6563
OIDCResponseType "{{ $vhost.OIDCResponseType }}"
6664
OIDCScope "{{ $vhost.OIDCScope }}"
@@ -75,7 +73,6 @@ CustomLog /dev/stdout proxy env=forwarded
7573
OIDCCacheType "{{ $vhost.OIDCCacheType }}"
7674
OIDCMemCacheServers "{{ $vhost.OIDCMemCacheServers }}"
7775

78-
7976
# The following directives are necessary to support websso from Horizon
8077
# (Per https://docs.openstack.org/keystone/pike/advanced-topics/federation/websso.html)
8178
OIDCRedirectURI "{{ $vhost.KeystoneEndpoint }}/v3/auth/OS-FEDERATION/identity_providers/{{ $vhost.KeystoneFederationIdentityProviderName }}/protocols/openid/websso"

‎tests/functional/base_test.go‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,6 @@ func GetTLSKeystoneAPISpec() map[string]interface{} {
6565
}
6666

6767
func CreateKeystoneAPI(name types.NamespacedName, spec map[string]interface{}) client.Object {
68-
6968
raw := map[string]interface{}{
7069
"apiVersion": "keystone.openstack.org/v1beta1",
7170
"kind": "KeystoneAPI",
@@ -91,7 +90,7 @@ func CreateKeystoneAPISecret(namespace string, name string) *corev1.Secret {
9190
types.NamespacedName{Namespace: namespace, Name: name},
9291
map[string][]byte{
9392
"AdminPassword": []byte("12345678"),
94-
"KeystoneOIDCClientSecret": []byte("secret"),
93+
"KeystoneOIDCClientSecret": []byte("secret123"),
9594
"KeystoneOIDCCryptoPassphrase": []byte("openstack"),
9695
},
9796
)

‎tests/functional/keystoneapi_controller_test.go‎

Lines changed: 110 additions & 87 deletions
Original file line numberDiff line numberDiff line change
@@ -1108,6 +1108,116 @@ var _ = Describe("Keystone controller", func() {
11081108
})
11091109
})
11101110

1111+
When("A TLS KeystoneAPI is created with an OIDC Federation configuration", func() {
1112+
BeforeEach(func() {
1113+
spec := GetTLSKeystoneAPISpec()
1114+
/* serviceOverride := map[string]interface{}{}
1115+
serviceOverride["public"] = map[string]interface{}{
1116+
"endpointURL": "https://keystone-openstack.apps-crc.testing",
1117+
}
1118+
spec["override"] = map[string]interface{}{
1119+
"service": serviceOverride,
1120+
} */
1121+
spec["oidcFederation"] = map[string]interface{}{
1122+
"keystoneFederationIdentityProviderName": "myidp",
1123+
"oidcCacheType": "memcache",
1124+
"oidcClaimDelimiter": ";",
1125+
"oidcClaimPrefix": "OIDC-",
1126+
"oidcClientID": "client123",
1127+
"oidcIntrospectionEndpoint": "https://idp.example.com/token/introspect",
1128+
"oidcPassClaimsAs": "both",
1129+
"oidcPassUserInfoAs": "claims",
1130+
"oidcProviderMetadataURL": "https://idp.example.com/.well-known/openid-configuration",
1131+
"oidcResponseType": "id_token",
1132+
"oidcScope": "openid email profile",
1133+
"remoteIDAttribute": "HTTP_OIDC_ISS",
1134+
}
1135+
1136+
DeferCleanup(k8sClient.Delete, ctx, th.CreateCABundleSecret(caBundleSecretName))
1137+
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(internalCertSecretName))
1138+
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(publicCertSecretName))
1139+
DeferCleanup(th.DeleteInstance, CreateKeystoneAPI(keystoneAPIName, spec))
1140+
DeferCleanup(
1141+
k8sClient.Delete, ctx, CreateKeystoneMessageBusSecret(namespace, "rabbitmq-secret"))
1142+
DeferCleanup(
1143+
k8sClient.Delete, ctx, CreateKeystoneAPISecret(namespace, SecretName))
1144+
DeferCleanup(infra.DeleteMemcached, infra.CreateMemcached(namespace, "memcached", memcachedSpec))
1145+
DeferCleanup(
1146+
mariadb.DeleteDBService,
1147+
mariadb.CreateDBService(
1148+
namespace,
1149+
GetKeystoneAPI(keystoneAPIName).Spec.DatabaseInstance,
1150+
corev1.ServiceSpec{
1151+
Ports: []corev1.ServicePort{{Port: 3306}},
1152+
},
1153+
),
1154+
)
1155+
mariadb.SimulateMariaDBAccountCompleted(keystoneAccountName)
1156+
mariadb.SimulateMariaDBDatabaseCompleted(keystoneDatabaseName)
1157+
infra.SimulateTransportURLReady(types.NamespacedName{
1158+
Name: fmt.Sprintf("%s-keystone-transport", keystoneAPIName.Name),
1159+
Namespace: namespace,
1160+
})
1161+
infra.SimulateMemcachedReady(types.NamespacedName{
1162+
Name: "memcached",
1163+
Namespace: namespace,
1164+
})
1165+
th.SimulateJobSuccess(dbSyncJobName)
1166+
th.SimulateJobSuccess(bootstrapJobName)
1167+
th.SimulateDeploymentReplicaReady(deploymentName)
1168+
})
1169+
1170+
/* It("registers LoadBalancer services keystone endpoints", func() {
1171+
instance := keystone.GetKeystoneAPI(keystoneAPIName)
1172+
Expect(instance).NotTo(BeNil())
1173+
Expect(instance.Status.APIEndpoints).To(HaveKeyWithValue("public", "https://keystone-openstack.apps-crc.testing"))
1174+
Expect(instance.Status.APIEndpoints).To(HaveKeyWithValue("internal", "https://keystone-internal."+keystoneAPIName.Namespace+".svc:5000"))
1175+
1176+
th.ExpectCondition(
1177+
keystoneAPIName,
1178+
ConditionGetterFunc(KeystoneConditionGetter),
1179+
condition.ReadyCondition,
1180+
corev1.ConditionTrue,
1181+
)
1182+
}) */
1183+
1184+
It("should configure OIDC in httpd.conf and keystone.conf", func() {
1185+
scrt := th.GetSecret(keystoneAPIConfigDataName)
1186+
Expect(scrt).ShouldNot(BeNil())
1187+
1188+
// Verify httpd.conf OIDC configuration
1189+
httpdConf := string(scrt.Data["httpd.conf"])
1190+
Expect(httpdConf).Should(ContainSubstring("OIDCClaimPrefix \"OIDC-\""))
1191+
Expect(httpdConf).Should(ContainSubstring("OIDCResponseType \"id_token\""))
1192+
Expect(httpdConf).Should(ContainSubstring("OIDCScope \"openid email profile\""))
1193+
Expect(httpdConf).Should(ContainSubstring("OIDCProviderMetadataURL https://idp.example.com/.well-known/openid-configuration"))
1194+
Expect(httpdConf).Should(ContainSubstring("OIDCClientID \"client123\""))
1195+
Expect(httpdConf).Should(ContainSubstring("OIDCClientSecret \"secret123\""))
1196+
Expect(httpdConf).Should(ContainSubstring("OIDCCryptoPassphrase \"openstack\""))
1197+
Expect(httpdConf).Should(ContainSubstring("OIDCCClaimDelimiter \";\""))
1198+
Expect(httpdConf).Should(ContainSubstring("OIDCCPassUserInfoAs \"claims\""))
1199+
Expect(httpdConf).Should(ContainSubstring("OIDCCPassClaimsAs \"both\""))
1200+
Expect(httpdConf).Should(ContainSubstring("OIDCCacheType \"memcache\""))
1201+
Expect(httpdConf).Should(ContainSubstring("OIDCRedirectURI \"https://keystone-openstack.apps-crc.testing/v3/auth/OS-FEDERATION/identity_providers/myidp/protocols/openid/websso\""))
1202+
Expect(httpdConf).Should(ContainSubstring("OIDCRedirectURI \"https://keystone-openstack.apps-crc.testing/v3/auth/OS-FEDERATION/websso/openid\""))
1203+
Expect(httpdConf).Should(ContainSubstring("LocationMatch \"/v3/auth/OS-FEDERATION/websso/openid\""))
1204+
Expect(httpdConf).Should(ContainSubstring("LocationMatch \"/v3/auth/OS-FEDERATION/identity_providers/myidp/protocols/openid/websso\""))
1205+
Expect(httpdConf).Should(ContainSubstring("OIDCAuthClientID \"client123\""))
1206+
Expect(httpdConf).Should(ContainSubstring("OIDCAuthClientSecret \"secret123\""))
1207+
Expect(httpdConf).Should(ContainSubstring("OIDCAuthIntrospectionEndpoint \"https://idp.example.com/token/introspect\""))
1208+
Expect(httpdConf).Should(ContainSubstring("Location ~ \"/v3/auth/OS-FEDERATION/identity_providers/myidp/protocols/openid/auth\""))
1209+
1210+
// Verify keystone.conf federation configuration
1211+
keystoneConf := string(scrt.Data["keystone.conf"])
1212+
Expect(keystoneConf).Should(ContainSubstring("[federation]"))
1213+
Expect(keystoneConf).Should(ContainSubstring("trusted_dashboard=https://keystone-openstack.apps-crc.testing/dashboard/auth/websso/"))
1214+
Expect(keystoneConf).Should(ContainSubstring("[openid]"))
1215+
Expect(keystoneConf).Should(ContainSubstring("remote_id_attribute = HTTP_OIDC_ISS"))
1216+
Expect(keystoneConf).Should(ContainSubstring("[auth]"))
1217+
Expect(keystoneConf).Should(ContainSubstring("methods = password,token,oauth1,mapped,application_credential,openid"))
1218+
})
1219+
})
1220+
11111221
When("When FernetMaxActiveKeys is created with a number lower than 3", func() {
11121222
It("should fail", func() {
11131223
err := InterceptGomegaFailure(
@@ -1556,93 +1666,6 @@ var _ = Describe("Keystone controller", func() {
15561666
})
15571667
})
15581668

1559-
When("A KeystoneAPI is created with OIDC Federation configuration", func() {
1560-
BeforeEach(func() {
1561-
spec := GetDefaultKeystoneAPISpec()
1562-
spec["oidcFederation"] = map[string]interface{}{
1563-
"idpName": "myidp",
1564-
"idpURL": "https://idp.example.com",
1565-
"idpClientID": "client123",
1566-
"idpClientSecret": "secret123",
1567-
"idpMetadataURL": "https://idp.example.com/.well-known/openid-configuration",
1568-
"idpUserInfoURL": "https://idp.example.com/userinfo",
1569-
"idpAuthURL": "https://idp.example.com/auth",
1570-
"idpTokenURL": "https://idp.example.com/token",
1571-
"idpRemoteIDClaim": "sub",
1572-
"idpUsernameClaim": "preferred_username",
1573-
"idpScopeClaim": "scope",
1574-
"idpRolesClaim": "roles",
1575-
"idpDomainName": "Default",
1576-
"idpDefaultProject": "demo",
1577-
"idpDefaultRole": "member",
1578-
"idpScopedTokenGroup": "oidc",
1579-
}
1580-
1581-
DeferCleanup(
1582-
k8sClient.Delete, ctx, CreateKeystoneMessageBusSecret(namespace, "rabbitmq-secret"))
1583-
DeferCleanup(th.DeleteInstance, CreateKeystoneAPI(keystoneAPIName, spec))
1584-
DeferCleanup(
1585-
k8sClient.Delete, ctx, CreateKeystoneAPISecret(namespace, SecretName))
1586-
DeferCleanup(infra.DeleteMemcached, infra.CreateMemcached(namespace, "memcached", memcachedSpec))
1587-
DeferCleanup(
1588-
mariadb.DeleteDBService,
1589-
mariadb.CreateDBService(
1590-
namespace,
1591-
GetKeystoneAPI(keystoneAPIName).Spec.DatabaseInstance,
1592-
corev1.ServiceSpec{
1593-
Ports: []corev1.ServicePort{{Port: 3306}},
1594-
},
1595-
),
1596-
)
1597-
mariadb.SimulateMariaDBAccountCompleted(keystoneAccountName)
1598-
mariadb.SimulateMariaDBDatabaseCompleted(keystoneDatabaseName)
1599-
infra.SimulateTransportURLReady(types.NamespacedName{
1600-
Name: fmt.Sprintf("%s-keystone-transport", keystoneAPIName.Name),
1601-
Namespace: namespace,
1602-
})
1603-
infra.SimulateMemcachedReady(types.NamespacedName{
1604-
Name: "memcached",
1605-
Namespace: namespace,
1606-
})
1607-
th.SimulateJobSuccess(dbSyncJobName)
1608-
th.SimulateJobSuccess(bootstrapJobName)
1609-
th.SimulateDeploymentReplicaReady(deploymentName)
1610-
})
1611-
1612-
It("should configure OIDC in httpd.conf and keystone.conf", func() {
1613-
scrt := th.GetSecret(keystoneAPIConfigDataName)
1614-
Expect(scrt).ShouldNot(BeNil())
1615-
1616-
// Verify httpd.conf OIDC configuration
1617-
httpdConf := string(scrt.Data["httpd.conf"])
1618-
Expect(httpdConf).Should(ContainSubstring("LoadModule auth_openidc_module modules/mod_auth_openidc.so"))
1619-
Expect(httpdConf).Should(ContainSubstring("OIDCProviderMetadataURL https://idp.example.com/.well-known/openid-configuration"))
1620-
Expect(httpdConf).Should(ContainSubstring("OIDCClientID client123"))
1621-
Expect(httpdConf).Should(ContainSubstring("OIDCClientSecret secret123"))
1622-
Expect(httpdConf).Should(ContainSubstring("OIDCRedirectURI https://keystone-public."))
1623-
Expect(httpdConf).Should(ContainSubstring("/v3/OS-FEDERATION/identity_providers/myidp/protocols/openid/auth"))
1624-
Expect(httpdConf).Should(ContainSubstring("OIDCRemoteUserClaim preferred_username"))
1625-
Expect(httpdConf).Should(ContainSubstring("OIDCProviderTokenEndpointAuth client_secret_basic"))
1626-
Expect(httpdConf).Should(ContainSubstring("OIDCScope \"openid profile email\""))
1627-
1628-
// Verify keystone.conf federation configuration
1629-
keystoneConf := string(scrt.Data["keystone.conf"])
1630-
Expect(keystoneConf).Should(ContainSubstring("[auth]"))
1631-
Expect(keystoneConf).Should(ContainSubstring("methods = password,token,oauth1,openid"))
1632-
Expect(keystoneConf).Should(ContainSubstring("[federation]"))
1633-
Expect(keystoneConf).Should(ContainSubstring("remote_id_attribute = HTTP_OIDC_ISS"))
1634-
Expect(keystoneConf).Should(ContainSubstring("[openid]"))
1635-
Expect(keystoneConf).Should(ContainSubstring("remote_id_claim = sub"))
1636-
Expect(keystoneConf).Should(ContainSubstring("username_claim = preferred_username"))
1637-
Expect(keystoneConf).Should(ContainSubstring("scope_claim = scope"))
1638-
Expect(keystoneConf).Should(ContainSubstring("roles_claim = roles"))
1639-
Expect(keystoneConf).Should(ContainSubstring("domain_name = Default"))
1640-
Expect(keystoneConf).Should(ContainSubstring("default_project = demo"))
1641-
Expect(keystoneConf).Should(ContainSubstring("default_role = member"))
1642-
Expect(keystoneConf).Should(ContainSubstring("scoped_token_group = oidc"))
1643-
})
1644-
})
1645-
16461669
// Run MariaDBAccount suite tests. these are pre-packaged ginkgo tests
16471670
// that exercise standard account create / update patterns that should be
16481671
// common to all controllers that ensure MariaDBAccount CRs.

0 commit comments

Comments
 (0)