@@ -1556,6 +1556,93 @@ var _ = Describe("Keystone controller", func() {
15561556 })
15571557 })
15581558
1559+ When ("A KeystoneAPI is created with OIDC Federation configuration" , func () {
1560+ BeforeEach (func () {
1561+ spec := GetDefaultKeystoneAPISpec ()
1562+ spec ["oidcFederation" ] = map [string ]interface {}{
1563+ "idpName" : "myidp" ,
1564+ "idpURL" : "https://idp.example.com" ,
1565+ "idpClientID" : "client123" ,
1566+ "idpClientSecret" : "secret123" ,
1567+ "idpMetadataURL" : "https://idp.example.com/.well-known/openid-configuration" ,
1568+ "idpUserInfoURL" : "https://idp.example.com/userinfo" ,
1569+ "idpAuthURL" : "https://idp.example.com/auth" ,
1570+ "idpTokenURL" : "https://idp.example.com/token" ,
1571+ "idpRemoteIDClaim" : "sub" ,
1572+ "idpUsernameClaim" : "preferred_username" ,
1573+ "idpScopeClaim" : "scope" ,
1574+ "idpRolesClaim" : "roles" ,
1575+ "idpDomainName" : "Default" ,
1576+ "idpDefaultProject" : "demo" ,
1577+ "idpDefaultRole" : "member" ,
1578+ "idpScopedTokenGroup" : "oidc" ,
1579+ }
1580+
1581+ DeferCleanup (
1582+ k8sClient .Delete , ctx , CreateKeystoneMessageBusSecret (namespace , "rabbitmq-secret" ))
1583+ DeferCleanup (th .DeleteInstance , CreateKeystoneAPI (keystoneAPIName , spec ))
1584+ DeferCleanup (
1585+ k8sClient .Delete , ctx , CreateKeystoneAPISecret (namespace , SecretName ))
1586+ DeferCleanup (infra .DeleteMemcached , infra .CreateMemcached (namespace , "memcached" , memcachedSpec ))
1587+ DeferCleanup (
1588+ mariadb .DeleteDBService ,
1589+ mariadb .CreateDBService (
1590+ namespace ,
1591+ GetKeystoneAPI (keystoneAPIName ).Spec .DatabaseInstance ,
1592+ corev1.ServiceSpec {
1593+ Ports : []corev1.ServicePort {{Port : 3306 }},
1594+ },
1595+ ),
1596+ )
1597+ mariadb .SimulateMariaDBAccountCompleted (keystoneAccountName )
1598+ mariadb .SimulateMariaDBDatabaseCompleted (keystoneDatabaseName )
1599+ infra .SimulateTransportURLReady (types.NamespacedName {
1600+ Name : fmt .Sprintf ("%s-keystone-transport" , keystoneAPIName .Name ),
1601+ Namespace : namespace ,
1602+ })
1603+ infra .SimulateMemcachedReady (types.NamespacedName {
1604+ Name : "memcached" ,
1605+ Namespace : namespace ,
1606+ })
1607+ th .SimulateJobSuccess (dbSyncJobName )
1608+ th .SimulateJobSuccess (bootstrapJobName )
1609+ th .SimulateDeploymentReplicaReady (deploymentName )
1610+ })
1611+
1612+ It ("should configure OIDC in httpd.conf and keystone.conf" , func () {
1613+ scrt := th .GetSecret (keystoneAPIConfigDataName )
1614+ Expect (scrt ).ShouldNot (BeNil ())
1615+
1616+ // Verify httpd.conf OIDC configuration
1617+ httpdConf := string (scrt .Data ["httpd.conf" ])
1618+ Expect (httpdConf ).Should (ContainSubstring ("LoadModule auth_openidc_module modules/mod_auth_openidc.so" ))
1619+ Expect (httpdConf ).Should (ContainSubstring ("OIDCProviderMetadataURL https://idp.example.com/.well-known/openid-configuration" ))
1620+ Expect (httpdConf ).Should (ContainSubstring ("OIDCClientID client123" ))
1621+ Expect (httpdConf ).Should (ContainSubstring ("OIDCClientSecret secret123" ))
1622+ Expect (httpdConf ).Should (ContainSubstring ("OIDCRedirectURI https://keystone-public." ))
1623+ Expect (httpdConf ).Should (ContainSubstring ("/v3/OS-FEDERATION/identity_providers/myidp/protocols/openid/auth" ))
1624+ Expect (httpdConf ).Should (ContainSubstring ("OIDCRemoteUserClaim preferred_username" ))
1625+ Expect (httpdConf ).Should (ContainSubstring ("OIDCProviderTokenEndpointAuth client_secret_basic" ))
1626+ Expect (httpdConf ).Should (ContainSubstring ("OIDCScope \" openid profile email\" " ))
1627+
1628+ // Verify keystone.conf federation configuration
1629+ keystoneConf := string (scrt .Data ["keystone.conf" ])
1630+ Expect (keystoneConf ).Should (ContainSubstring ("[auth]" ))
1631+ Expect (keystoneConf ).Should (ContainSubstring ("methods = password,token,oauth1,openid" ))
1632+ Expect (keystoneConf ).Should (ContainSubstring ("[federation]" ))
1633+ Expect (keystoneConf ).Should (ContainSubstring ("remote_id_attribute = HTTP_OIDC_ISS" ))
1634+ Expect (keystoneConf ).Should (ContainSubstring ("[openid]" ))
1635+ Expect (keystoneConf ).Should (ContainSubstring ("remote_id_claim = sub" ))
1636+ Expect (keystoneConf ).Should (ContainSubstring ("username_claim = preferred_username" ))
1637+ Expect (keystoneConf ).Should (ContainSubstring ("scope_claim = scope" ))
1638+ Expect (keystoneConf ).Should (ContainSubstring ("roles_claim = roles" ))
1639+ Expect (keystoneConf ).Should (ContainSubstring ("domain_name = Default" ))
1640+ Expect (keystoneConf ).Should (ContainSubstring ("default_project = demo" ))
1641+ Expect (keystoneConf ).Should (ContainSubstring ("default_role = member" ))
1642+ Expect (keystoneConf ).Should (ContainSubstring ("scoped_token_group = oidc" ))
1643+ })
1644+ })
1645+
15591646 // Run MariaDBAccount suite tests. these are pre-packaged ginkgo tests
15601647 // that exercise standard account create / update patterns that should be
15611648 // common to all controllers that ensure MariaDBAccount CRs.
0 commit comments