Move changes from PR that created the spring auth server

MarcialRosales · MarcialRosales · commit 7ff9d5162b01 · 2025-07-08T13:18:38.000+02:00
diff --git a/selenium/authorization-server/HELP.md b/selenium/authorization-server/HELP.md
@@ -0,0 +1,21 @@
+# Read Me First
+The following was discovered as part of building this project:
+
+* The original package name 'com.rabbitmq.authorization-server' is invalid and this project uses 'com.rabbitmq.authorization_server' instead.
+
+# Getting Started
+
+### Reference Documentation
+For further reference, please consider the following sections:
+
+* [Official Apache Maven documentation](https://maven.apache.org/guides/index.html)
+* [Spring Boot Maven Plugin Reference Guide](https://docs.spring.io/spring-boot/3.5.0/maven-plugin)
+* [Create an OCI image](https://docs.spring.io/spring-boot/3.5.0/maven-plugin/build-image.html)
+
+### Maven Parent overrides
+
+Due to Maven's design, elements are inherited from the parent POM to the project POM.
+While most of the inheritance is fine, it also inherits unwanted elements like `<license>` and `<developers>` from the parent.
+To prevent this, the project POM contains empty overrides for these elements.
+If you manually switch to a different parent and actually want the inheritance, you need to remove those overrides.
+
diff --git a/selenium/suites/authnz-messaging/auth-cache-http-backends.sh b/selenium/suites/authnz-messaging/auth-cache-http-backends.sh
@@ -3,7 +3,7 @@
 SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 TEST_CASES_PATH=/authnz-msg-protocols
-PROFILES="http-user auth-http auth_backends-cache-http "
+PROFILES="amqp-http-user auth-http auth_backends-cache-http "
 
 source $SCRIPT/../../bin/suite_template
 runWith mock-auth-backend-http
diff --git a/selenium/suites/authnz-messaging/auth-cache-ldap-backends.sh b/selenium/suites/authnz-messaging/auth-cache-ldap-backends.sh
@@ -3,7 +3,7 @@
 SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 TEST_CASES_PATH=/authnz-msg-protocols
-PROFILES="ldap-user auth-ldap auth_backends-cache-ldap"
+PROFILES="amqp-ldap-user auth-ldap auth_backends-cache-ldap"
 
 source $SCRIPT/../../bin/suite_template
 runWith mock-auth-backend-ldap
diff --git a/selenium/suites/authnz-messaging/auth-http-backend-with-mtls.sh b/selenium/suites/authnz-messaging/auth-http-backend-with-mtls.sh
@@ -3,7 +3,7 @@
 SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 TEST_CASES_PATH=/authnz-msg-protocols
-PROFILES="internal-user auth-http auth_backends-http auth-mtls"
+PROFILES="amqp-internal-user auth-http auth_backends-http auth-mtls"
 # internal-user profile is used because the client certificates to 
 # access rabbitmq are issued with the alt_name = internal-user 
 
diff --git a/selenium/suites/authnz-messaging/auth-http-internal-backends-with-internal.sh b/selenium/suites/authnz-messaging/auth-http-internal-backends-with-internal.sh
@@ -3,7 +3,7 @@
 SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 TEST_CASES_PATH=/authnz-msg-protocols
-PROFILES="internal-user auth-http auth_backends-http-internal "
+PROFILES="amqp-internal-user auth-http auth_backends-http-internal "
 
 source $SCRIPT/../../bin/suite_template
 runWith mock-auth-backend-http
diff --git a/selenium/suites/authnz-messaging/auth-http-internal-backends.sh b/selenium/suites/authnz-messaging/auth-http-internal-backends.sh
@@ -3,7 +3,7 @@
 SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 TEST_CASES_PATH=/authnz-msg-protocols
-PROFILES="http-user auth-http auth_backends-http-internal "
+PROFILES="amqp-http-user auth-http auth_backends-http-internal "
 
 source $SCRIPT/../../bin/suite_template
 runWith mock-auth-backend-http
diff --git a/selenium/suites/authnz-messaging/auth-internal-backend.sh b/selenium/suites/authnz-messaging/auth-internal-backend.sh
@@ -3,7 +3,7 @@
 SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 TEST_CASES_PATH=/authnz-msg-protocols
-PROFILES="internal-user auth_backends-internal"
+PROFILES="amqp-internal-user auth_backends-internal"
 
 source $SCRIPT/../../bin/suite_template
 run
diff --git a/selenium/suites/authnz-messaging/auth-internal-http-backends.sh b/selenium/suites/authnz-messaging/auth-internal-http-backends.sh
@@ -3,7 +3,7 @@
 SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 TEST_CASES_PATH=/authnz-msg-protocols
-PROFILES="internal-user auth_http auth_backends-internal-http "
+PROFILES="amqp-internal-user auth_http auth_backends-internal-http "
 
 source $SCRIPT/../../bin/suite_template
 runWith mock-auth-backend-http
diff --git a/selenium/suites/authnz-messaging/auth-internal-mtls-backend.sh b/selenium/suites/authnz-messaging/auth-internal-mtls-backend.sh
@@ -3,7 +3,7 @@
 SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 TEST_CASES_PATH=/authnz-msg-protocols
-PROFILES="internal-user auth_backends-internal tls auth-mtls"
+PROFILES="amqp-internal-user auth_backends-internal tls auth-mtls"
 
 source $SCRIPT/../../bin/suite_template
 run
diff --git a/selenium/suites/authnz-messaging/auth-ldap-backend.sh b/selenium/suites/authnz-messaging/auth-ldap-backend.sh
@@ -3,7 +3,7 @@
 SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 TEST_CASES_PATH=/authnz-msg-protocols
-PROFILES="ldap-user auth-ldap auth_backends-ldap "
+PROFILES="amqp-ldap-user auth-ldap auth_backends-ldap "
 
 source $SCRIPT/../../bin/suite_template
 runWith mock-auth-backend-ldap
diff --git a/selenium/suites/authnz-messaging/auth-oauth-backend-with-opaque-tokens.sh b/selenium/suites/authnz-messaging/auth-oauth-backend-with-opaque-tokens.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+TEST_CASES_PATH=/authnz-msg-protocols
+PROFILES="spring oauth-producer auth-oauth-spring auth_backends-opaque-oauth "
+
+source $SCRIPT/../../bin/suite_template
+runWith spring
diff --git a/selenium/suites/authnz-messaging/spring/application.yml b/selenium/suites/authnz-messaging/spring/application.yml
@@ -0,0 +1,37 @@
+server:
+  port: 8443
+  ssl:
+    bundle: spring-authorizationserver
+
+spring:
+  ssl:
+    bundle:
+      jks:
+        spring-authorizationserver:
+          key:
+            alias: server-spring-tls
+            password: foobar
+          keystore:
+            location: /config/server_spring.jks
+            password: foobar
+            type: PKCS12
+  security:
+    oauth2:      
+      authorizationserver:
+        client:
+          producer:
+            registration:
+              provider: spring
+              client-id: producer
+              client-secret: producer
+              authorization-grant-types: 
+                - client_credentials
+              client-authentication-methods:
+                - client_secret_basic
+              scopes: 
+                - rabbitmq.configure:*/*
+                - rabbitmq.read:*/*
+                - rabbitmq.write:*/*
+              client-name: producer
+            token:
+                access-token-format: reference
diff --git a/selenium/suites/authnz-messaging/spring/openssl.cnf.in b/selenium/suites/authnz-messaging/spring/openssl.cnf.in
@@ -0,0 +1,3 @@
+[ client_alt_names ]
+email.1 = rabbit_client@localhost
+URI.1 = rabbit_client_id_uri
diff --git a/selenium/suites/authnz-mgt/oauth-with-spring.sh b/selenium/suites/authnz-mgt/oauth-with-spring.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+
+SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+TEST_CASES_PATH=/oauth/with-sp-initiated
+TEST_CONFIG_PATH=/oauth
+PROFILES="spring spring-oauth-provider tls"
+
+source $SCRIPT/../../bin/suite_template $@
+runWith spring
diff --git a/selenium/test/authnz-msg-protocols/env.amqp-http-user b/selenium/test/authnz-msg-protocols/env.amqp-http-user
diff --git a/selenium/test/authnz-msg-protocols/env.amqp-internal-user b/selenium/test/authnz-msg-protocols/env.amqp-internal-user
diff --git a/selenium/test/authnz-msg-protocols/env.amqp-ldap-user b/selenium/test/authnz-msg-protocols/env.amqp-ldap-user
diff --git a/selenium/test/authnz-msg-protocols/env.auth-oauth-spring.docker b/selenium/test/authnz-msg-protocols/env.auth-oauth-spring.docker
@@ -0,0 +1,4 @@
+export SPRING_URL=https://spring:8443
+export OAUTH_PROVIDER_URL=https://spring:8443
+export SPRING_CA_CERT=/config/ca_spring_certificate.pem
+export OAUTH_NODE_EXTRA_CA_CERTS=/config/ca_spring_certificate.pem
diff --git a/selenium/test/authnz-msg-protocols/env.auth-oauth-spring.local b/selenium/test/authnz-msg-protocols/env.auth-oauth-spring.local
@@ -0,0 +1,4 @@
+export SPRING_URL=https://localhost:8443
+export OAUTH_PROVIDER_URL=https://localhost:8443
+export SPRING_CA_CERT=${TEST_CONFIG_PATH}/spring/ca_spring_certificate.pem
+export OAUTH_NODE_EXTRA_CA_CERTS=authnz-msg-protocols/spring/ca_spring_certificate.pem
diff --git a/selenium/test/authnz-msg-protocols/env.oauth-producer b/selenium/test/authnz-msg-protocols/env.oauth-producer
@@ -0,0 +1,3 @@
+export RABBITMQ_AMQP_USERNAME=oauth
+export OAUTH_CLIENT_ID=producer
+export OAUTH_CLIENT_SECRET=producer
diff --git a/selenium/test/authnz-msg-protocols/rabbitmq.auth_backends-opaque-oauth.conf b/selenium/test/authnz-msg-protocols/rabbitmq.auth_backends-opaque-oauth.conf
@@ -0,0 +1,15 @@
+log.console.level = debug
+
+auth_backends.1 = rabbit_auth_backend_oauth2
+
+# Common auth_oauth2 settings for all resources
+auth_oauth2.preferred_username_claims.1 = sub
+
+## Resource server hosted by this rabbitmq instance
+auth_oauth2.resource_server_id = rabbitmq
+auth_oauth2.verify_aud = false 
+auth_oauth2.issuer = ${SPRING_URL}
+auth_oauth2.https.cacertfile = ${SPRING_CA_CERT}
+auth_oauth2.https.verify = verify_peer
+auth_oauth2.https.hostname_verification = wildcard
+
diff --git a/selenium/test/authnz-msg-protocols/spring/application.yml b/selenium/test/authnz-msg-protocols/spring/application.yml
@@ -0,0 +1,69 @@
+server:
+  port: 8443
+  ssl:
+    bundle: spring-authorizationserver
+
+spring:
+  ssl:
+    bundle:
+      jks:
+        spring-authorizationserver:
+          key:
+            alias: server-spring-tls
+            password: foobar
+          keystore:
+            location: /config/server_spring.jks
+            password: foobar
+            type: PKCS12
+  security:
+    oauth2:
+      users:
+        - username: rabbit_admin
+          password: rabbit_admin 
+          scopes: 
+            - openid 
+            - profile 
+            - rabbitmq.tag:administrator
+          audiencies: 
+            - rabbitmq
+      authorizationserver:
+        client:
+          producer:
+            registration:
+              provider: spring
+              client-id: producer
+              client-secret: "{noop}producer"
+              authorization-grant-types: 
+                - client_credentials
+              client-authentication-methods:
+                - client_secret_post
+#              token-settings:
+#                access-token-format: reference              
+              scopes: 
+                - openid
+                - profile
+                - rabbitmq.tag:management
+                - rabbitmq.configure:*/*
+                - rabbitmq.read:*/*
+                - rabbitmq.write:*/*
+              client-name: producer
+          rabbitmq_client_code:
+            registration:
+              provider: spring
+              client-id: rabbitmq_client_code
+              require-proof-key: true              
+              authorization-grant-types: 
+                - authorization_code
+              client-authentication-methods:
+                - none
+              redirect-uris: 
+                - "${RABBITMQ_SCHEME}://${RABBITMQ_HOST}${RABBITMQ_PATH}/js/oidc-oauth/login-callback.html"
+              post-logout-redirect-uris:
+                - "${RABBITMQ_SCHEME}://${RABBITMQ_HOST}${RABBITMQ_PATH}/"
+              scopes: 
+                - openid 
+                - profile 
+                - rabbitmq.tag:administrator
+                - rabbitmq.tag:management
+              client-name: rabbitmq_client_code
+              
diff --git a/selenium/test/authnz-msg-protocols/spring/openssl.cnf.in b/selenium/test/authnz-msg-protocols/spring/openssl.cnf.in
@@ -0,0 +1,3 @@
+[ client_alt_names ]
+email.1 = rabbit_client@localhost
+URI.1 = rabbit_client_id_uri
diff --git a/selenium/test/oauth/env.docker.spring b/selenium/test/oauth/env.docker.spring
@@ -0,0 +1,2 @@
+export SPRING_URL=https://spring:8443
+export SPRING_CA_CERT=/config/oauth/spring/ca_spring_certificate.pem
diff --git a/selenium/test/oauth/env.local.spring b/selenium/test/oauth/env.local.spring
@@ -0,0 +1,3 @@
+export SPRING_URL=https://localhost:8443
+export OAUTH_PROVIDER_URL=${SPRING_URL}
+export SPRING_CA_CERT=selenium/test/oauth/spring/ca_spring_certificate.pem
diff --git a/selenium/test/oauth/env.spring b/selenium/test/oauth/env.spring
@@ -0,0 +1,2 @@
+export OAUTH_SERVER_CONFIG_DIR=${OAUTH_SERVER_CONFIG_BASEDIR}/oauth/spring
+export OAUTH_SCOPES="openid profile rabbitmq.tag:management"
diff --git a/selenium/test/oauth/env.spring-oauth-provider b/selenium/test/oauth/env.spring-oauth-provider
@@ -0,0 +1,2 @@
+export OAUTH_PROVIDER_URL=${SPRING_URL}
+export OAUTH_PROVIDER_CA_CERT=${SPRING_CA_CERT}
diff --git a/selenium/test/oauth/rabbitmq.conf b/selenium/test/oauth/rabbitmq.conf
@@ -1,5 +1,7 @@
 auth_backends.1 = rabbit_auth_backend_oauth2
 
+log.console.level = debug
+
 management.login_session_timeout = 1
 management.oauth_enabled = true
 management.oauth_client_id = rabbitmq_client_code
diff --git a/selenium/test/oauth/rabbitmq.spring-oauth-provider.conf b/selenium/test/oauth/rabbitmq.spring-oauth-provider.conf
@@ -0,0 +1,3 @@
+auth_oauth2.issuer = ${SPRING_URL}
+auth_oauth2.https.cacertfile = ${SPRING_CA_CERT}
+auth_oauth2.additional_scopes_key = extra_scope
diff --git a/selenium/test/oauth/spring/application.yml b/selenium/test/oauth/spring/application.yml
@@ -0,0 +1,65 @@
+server:
+  port: 8443
+  ssl:
+    bundle: spring-authorizationserver
+
+spring:
+  ssl:
+    bundle:
+      jks:
+        spring-authorizationserver:
+          key:
+            alias: server-spring-tls
+            password: foobar
+          keystore:
+            location: /config/server_spring.jks
+            password: foobar
+            type: PKCS12
+  security:
+    oauth2:
+      users:
+        - username: rabbit_admin
+          password: rabbit_admin 
+          scopes: 
+            - openid 
+            - profile 
+            - rabbitmq.tag:administrator
+          audiencies: 
+            - rabbitmq
+      authorizationserver:
+        client:
+          mgt_api_client:
+            registration:
+              provider: spring
+              client-id: mgt_api_client
+              authorization-grant-types: 
+                - client_credentials
+              client-authentication-methods:
+                - client_secret_basic
+              token-settings:
+                access-token-format: reference              
+              scopes: 
+                - openid
+                - profile
+                - rabbitmq.tag:management
+              client-name: mgt_api_client
+          rabbitmq_client_code:
+            registration:
+              provider: spring
+              client-id: rabbitmq_client_code
+              require-proof-key: true              
+              authorization-grant-types: 
+                - authorization_code
+              client-authentication-methods:
+                - none
+              redirect-uris: 
+                - "${RABBITMQ_SCHEME}://${RABBITMQ_HOST}${RABBITMQ_PATH}/js/oidc-oauth/login-callback.html"
+              post-logout-redirect-uris:
+                - "${RABBITMQ_SCHEME}://${RABBITMQ_HOST}${RABBITMQ_PATH}/"
+              scopes: 
+                - openid 
+                - profile 
+                - rabbitmq.tag:administrator
+                - rabbitmq.tag:management
+              client-name: rabbitmq_client_code
+              
diff --git a/selenium/test/oauth/spring/openssl.cnf.in b/selenium/test/oauth/spring/openssl.cnf.in
@@ -0,0 +1,3 @@
+[ client_alt_names ]
+email.1 = rabbit_client@localhost
+URI.1 = rabbit_client_id_uri
