Add just the testing setup from #26.

Important: there are changes here to adapt the tests and the Keycloak test realm that are incompatible with the changes in #29. Ultimately, the changes in #29 need to be applied over this.
2026-07-19 10:27:51 +02:00 · 2026-07-19 10:27:51 +02:00 · f204ab7f28
commit f204ab7f28
parent 6cd678b414
8 changed files with 428 additions and 27 deletions
--- a/testing/README.md
+++ b/testing/README.md
@ -1,9 +1,11 @@
-# Creating a Testing Keycloak
+# Integration Testing
+
+This directory contains infrastructure and tests to verify end-to-end operation of the provider.
+
+## Creating a Testing Keycloak

 The Docker Compose setup in this directory sets up Keycloak and imports a realm `testing`.

-## Starting Keycloak
-
 Run `docker compose up -d` to start Keycloak. The admin console will be available at http://localhost:8080/.

 You can attach a Java debugger at `localhost:8081`.
@ -11,7 +13,7 @@ You can attach a Java debugger at `localhost:8081`.
 The realm export is in `import/testing.json`.
 It will be imported automatically when Keycloak starts.

-## Updating the Realm
+### Updating the Realm

 If you want to make changes to the testing realm and persist them, you need to export the realm.

@ -25,16 +27,36 @@ docker compose exec -it keycloak sh -c "cp -rp /opt/keycloak/data/h2 /tmp && env

 ## Running Integration Tests

-This directory also contains shell scripts that exercise the attribute endpoint.
+This directory contains shell scripts that exercise the attribute endpoint.

 Bring up Keycloak with `docker compose up -d`, then run one of the `client-test-export-`*`.sh` scripts.

 ```shell
 $ ./client-test-export-dooris.sh
+All attributes collated into a single list
 [
  "hacker-ssh-key-1",
  "hacker-ssh-key-2"
 ]
+Results mapped per attribute
+{
+  "ssh-key-1": [
+    "hacker-ssh-key-1"
+  ],
+  "ssh-key-2": [
+    "hacker-ssh-key-2"
+  ]
+}
+$ ./client-test-export-mailing-lists.sh 
+chaos@
+[
+  "hacker+chaos@example.net",
+  "tester+chaos@example.com"
+]
+intern@
+[
+  "hacker+intern@example.net"
+]
 ```

 ##  Realm `testing` Configuration
@ -43,16 +65,16 @@ The realm contains these objects:

 * Clients:
  * `export-dooris-ssh-keys` with secret `export-dooris-ssh-keys-secret` and user `service-account-export-dooris-ssh-keys` 
-  * `export-mailing-list-addresses` with secret `export-mailing-list-addresses-secret` and role `export-mailing-list-addresses`
+  * `export-mailing-list-addresses` with secret `export-mailing-list-addresses-secret` and user `service-account-export-mailing-list-addresses`
 * Realm Roles:
-  * `dooris-authorized`
-  * `mailing-list-chaos-member`
-  * `mailing-list-intern-member`
-  * `export-dooris-ssh-keys`
-  * `export-mailing-list-addresses`
+  * `dooris-authorized` to assign to users whose SSH keys should be exported
+  * `mailing-list-chaos-member` to assign to users who are a member of the chaos mailing list
+  * `mailing-list-intern-member` to assign to users who are a member of the intern mailing list
+  * `export-dooris-ssh-keys` to assign to service account users that should be allowed to use the dooris endpoint config
+  * `export-mailing-list-addresses` to assign to service account users that should be allowed to use the mailing list endpoint configs
 * Groups:
  * `chaos` with role `mailing-list-chaos-member`
-  * `ìntern` with roles `dooris-authorized` and `mailing-list-intern-member`
+  * `ìntern` with roles `dooris-authorized`, `mailing-list-chaos-member` and `mailing-list-intern-member`
 * Users:
  * `tester` (Tony Tester), email `tester@example.com`, member of group `chaos`
    * Mailing List Addresses:
@ -81,7 +103,7 @@ The realm contains these objects:
      * `mailing-list-address-chaos`
        * Attribute Group `mailing-list-addresses`
      * `mailing-list-address-intern`
-        * Attribute Group `mailing-list-intern`
+        * Attribute Group `mailing-list-addresses`
      * `ssh-key-1`
        * Attribute Group `dooris-ssh-keys`
      * `ssh-key-2`
--- a/testing/client-test-export-dooris.sh
+++ b/testing/client-test-export-dooris.sh
@ -7,14 +7,21 @@
 set -e

 ACCESS_TOKEN="$(curl -s --request POST \
-    --url http://localhost:8080/realms/testing/protocol/openid-connect/token \
-    --header 'content-type: application/x-www-form-urlencoded' \
-    --data scope=openid \
-    --data client_id=export-dooris-ssh-keys \
-    --data client_secret=export-dooris-ssh-keys-secret \
-    --data grant_type=client_credentials | jq --raw-output .access_token -)"
+  --url http://localhost:8080/realms/testing/protocol/openid-connect/token \
+  --header 'content-type: application/x-www-form-urlencoded' \
+  --data scope=openid \
+  --data client_id=export-dooris-ssh-keys \
+  --data client_secret=export-dooris-ssh-keys-secret \
+  --data grant_type=client_credentials | jq --raw-output .access_token -)"

+echo "All attributes collated into a single list"
 curl -s --request GET \
-             --url http://localhost:8080/realms/testing/attribute-endpoints-provider/export/dooris-ssh-keys \
-             --header "authorization: Bearer ${ACCESS_TOKEN}" \
-             --header "content-type: application/json" | jq . -
+  --url http://localhost:8080/realms/testing/attribute-endpoints-provider/export/dooris-ssh-keys \
+  --header "authorization: Bearer ${ACCESS_TOKEN}" \
+  --header "content-type: application/json" | jq . -
+
+echo "Results mapped per attribute"
+curl -s --request GET \
+  --url http://localhost:8080/realms/testing/attribute-endpoints-provider/export/dooris-ssh-keys/map \
+  --header "authorization: Bearer ${ACCESS_TOKEN}" \
+  --header "content-type: application/json" | jq . -
--- a/testing/client-test-export-mailing-lists.sh
+++ b/testing/client-test-export-mailing-lists.sh
@ -0,0 +1,27 @@
+#!/bin/sh
+
+#
+# Use curl to run a test export of Dooris ssh keys
+#
+
+set -e
+
+ACCESS_TOKEN="$(curl -s --request POST \
+  --url http://localhost:8080/realms/testing/protocol/openid-connect/token \
+  --header 'content-type: application/x-www-form-urlencoded' \
+  --data scope=openid \
+  --data client_id=export-mailing-list-addresses \
+  --data client_secret=export-mailing-list-addresses-secret \
+  --data grant_type=client_credentials | jq --raw-output .access_token -)"
+
+echo "chaos@"
+curl -s --request GET \
+  --url http://localhost:8080/realms/testing/attribute-endpoints-provider/export/mailing-list-addresses-chaos \
+  --header "authorization: Bearer ${ACCESS_TOKEN}" \
+  --header "content-type: application/json" | jq . -
+
+echo "intern@"
+curl -s --request GET \
+  --url http://localhost:8080/realms/testing/attribute-endpoints-provider/export/mailing-list-addresses-intern \
+  --header "authorization: Bearer ${ACCESS_TOKEN}" \
+  --header "content-type: application/json" | jq . -
--- a/testing/compose.yaml
+++ b/testing/compose.yaml
@ -12,6 +12,17 @@ services:
    ports:
      - "8080:8080"
      - "8081:8081"
+    networks:
+      - keycloak
    volumes:
      - ./import:/opt/keycloak/data/import/
-      - ../attribute-endpoints-provider/target/attribute-endpoints-provider-1.0-SNAPSHOT.jar:/opt/keycloak/providers/attribute-endpoints-provider.jar
+      - ../attribute-endpoints-provider/target/attribute-endpoints-provider-1.0-SNAPSHOT.jar:/opt/keycloak/providers/attribute-endpoints-provider.jar
+
+networks:
+  # force a "local" IP address that Keycloak accepts HTTP (not HTTPS) requests from
+  keycloak:
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 192.168.231.128/29
+          gateway: 192.168.231.129
--- a/testing/import/testing.json
+++ b/testing/import/testing.json
@ -1478,7 +1478,7 @@
      "subType" : "authenticated",
      "subComponents" : { },
      "config" : {
-        "allowed-protocol-mapper-types" : [ "oidc-sha256-pairwise-sub-mapper", "saml-user-attribute-mapper", "saml-user-property-mapper", "oidc-full-name-mapper", "saml-role-list-mapper", "oidc-address-mapper", "oidc-usermodel-attribute-mapper", "oidc-usermodel-property-mapper" ]
+        "allowed-protocol-mapper-types" : [ "saml-user-property-mapper", "oidc-usermodel-property-mapper", "saml-role-list-mapper", "oidc-full-name-mapper", "saml-user-attribute-mapper", "oidc-address-mapper", "oidc-usermodel-attribute-mapper", "oidc-sha256-pairwise-sub-mapper" ]
      }
    }, {
      "id" : "a49de9bf-462b-4c61-bb52-0373732f4b1b",
@ -1538,7 +1538,7 @@
      "subType" : "anonymous",
      "subComponents" : { },
      "config" : {
-        "allowed-protocol-mapper-types" : [ "saml-role-list-mapper", "oidc-address-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-usermodel-attribute-mapper", "oidc-full-name-mapper", "oidc-usermodel-property-mapper", "saml-user-property-mapper", "saml-user-attribute-mapper" ]
+        "allowed-protocol-mapper-types" : [ "saml-role-list-mapper", "saml-user-attribute-mapper", "oidc-usermodel-attribute-mapper", "oidc-usermodel-property-mapper", "saml-user-property-mapper", "oidc-full-name-mapper", "oidc-address-mapper", "oidc-sha256-pairwise-sub-mapper" ]
      }
    }, {
      "id" : "dd4024e9-f080-4319-aeb7-7f9906c345c5",
@ -1605,8 +1605,8 @@
      "subComponents" : { },
      "config" : {
        "match-role" : [ "mailing-list-intern-member" ],
-        "auth-role" : [ "export-mailing-list-addresses" ],
        "attribute-group" : [ "mailing-list-addresses" ],
+        "auth-role" : [ "export-mailing-list-addresses" ],
        "slug" : [ "mailing-list-addresses-intern" ]
      }
    }, {
@ -1615,8 +1615,8 @@
      "subComponents" : { },
      "config" : {
        "match-role" : [ "dooris-authorized" ],
-        "auth-role" : [ "export-dooris-ssh-keys" ],
        "attribute-group" : [ "dooris-ssh-keys" ],
+        "auth-role" : [ "export-dooris-ssh-keys" ],
        "slug" : [ "dooris-ssh-keys" ]
      }
    }, {