Mocking keycloack in tests and OidcWiremockTestResource class

[b0ro]

Hello,

I'm trying to mock keycloak server in my extension integration test, so the test case was at the begining as follows:

@QuarkusTestResource(OidcWiremockTestResource::class)
class ExtendedHealthExtensionTest {
 
    ...

    companion object {
        @RegisterExtension
        val unitTest: QuarkusUnitTest = QuarkusUnitTest()
            .withEmptyApplication()
            .withConfigurationResource("application.properties");

        @BeforeAll
        @JvmStatic
        fun setup() {
            filters(RequestLoggingFilter(), ResponseLoggingFilter())
        }
    }
}

and my config file contained:

mp.jwt.verify.token=${keycloak.url}/realms/quarkus/protocol/openid-connect/token
mp.jwt.verify.issuer=${keycloak.url}/realms/quarkus
mp.jwt.verify.publickey.location=${keycloak.url}/realms/quarkus/protocol/openid-connect/certs

I basically followed what was described in:
https://quarkus.io/guides/security-oidc-bearer-token-authentication#integration-testing

but I was getting the following error:

[ERROR]   ExtendedHealthExtensionTest » Runtime io.smallrye.config.ConfigValidationException: Configuration validation failed:
	java.util.NoSuchElementException: SRCFG00011: Could not expand value keycloak.url in property mp.jwt.verify.token
	java.util.NoSuchElementException: SRCFG00011: Could not expand value keycloak.url in property mp.jwt.verify.publickey.location
	java.util.NoSuchElementException: SRCFG00011: Could not expand value keycloak.url in property mp.jwt.verify.issuer

So then I've just written my own mock which extended the OidcWiremockTestResource:

class KeycloakWireMock: OidcWiremockTestResource() {

    override fun start(): MutableMap<String, String> {
        val config = super.start()
        val keycloakUrl = config["keycloak.url"]

        return mutableMapOf(
            "mp.jwt.verify.token" to "$keycloakUrl/realms/quarkus/protocol/openid-connect/token",
            "mp.jwt.verify.issuer" to "$keycloakUrl/realms/quarkus",
            "mp.jwt.verify.publickey.location" to "$keycloakUrl/realms/quarkus/protocol/openid-connect/certs",
        )
    }
}

and I've changed the annotation to:

@QuarkusTestResource(KeycloakWireMock::class)

and now I'm getting:

2024-07-25 16:04:37,880 WARN  [io.qua.run.con.ConfigRecorder] (main) Build time property cannot be changed at runtime:
 - mp.jwt.verify.issuer is set to 'http://localhost:53806/auth/realms/quarkus' but it is build time fixed to 'https://old-host/auth/realms/quarkus'. Did you change the property mp.jwt.verify.issuer after building the application?
 - mp.jwt.verify.token is set to 'http://localhost:53806/auth/realms/quarkus/protocol/openid-connect/token' but it is build time fixed to 'https://old-host/auth/realms/quarkus/protocol/openid-connect/token'. Did you change the property mp.jwt.verify.token after building the application?
 - mp.jwt.verify.publickey.location is set to 'http://localhost:53806/auth/realms/quarkus/protocol/openid-connect/certs' but it is build time fixed to 'https://old-host/auth/realms/quarkus/protocol/openid-connect/certs'. Did you change the property mp.jwt.verify.publickey.location after building the application?

and tests are using old-host instead of the values injected by KeycloakWireMock. So is it still possible to mock keycloack in my tests?

#tests #keycloak #kotlin

[quarkus-bot[bot]]

/cc @geoand (kotlin), @pedroigor (oidc), @sberyozkin (oidc)

[sberyozkin]

@b0ro, I have to admit I'm not sure why keycloak.url is not visible in the first case, since your 2nd case confirms OidcWiremockTestResource sets it, we also have a few integration tests depending on it.

Feels like some class loader ordering issue.

Can you try your 2nd case again but without setting smallrye jwt props ?

[b0ro]

@sberyozkin, hello. If I remove smallrye jwt props from the case 2, I will get case 1. The way I understand this error is that those smallrye jwt props are build time props and OidcWiremockTestResource is updating them in the runtime, that's why new values are ignored and keycloak.url cannot be expanded. Or maybe it's because I use it in my extension test?