diff --git a/.forgejo/workflows/test.yaml b/.forgejo/workflows/verify.yaml similarity index 53% rename from .forgejo/workflows/test.yaml rename to .forgejo/workflows/verify.yaml index eaba13b..9f88d22 100644 --- a/.forgejo/workflows/test.yaml +++ b/.forgejo/workflows/verify.yaml @@ -1,10 +1,12 @@ on: pull_request: push: + branches: + - main jobs: - test: - name: Test + ansible-lint: + name: Verify runs-on: docker steps: - uses: actions/checkout@v7 @@ -12,6 +14,6 @@ jobs: run: | apt update apt install -y maven - - name: Run maven verify test + - name: Run maven verify run: | - mvn -f attribute-endpoints-provider verify test + mvn -f attribute-endpoints-provider --batch-mode --no-transfer-progress verify diff --git a/Makefile b/Makefile index dd1858b..767aa28 100644 --- a/Makefile +++ b/Makefile @@ -1,12 +1,6 @@ -install: - mvn -f attribute-endpoints-provider install - verify: mvn -f attribute-endpoints-provider verify -test: - mvn -f attribute-endpoints-provider test - clean: mvn -f attribute-endpoints-provider clean diff --git a/README.md b/README.md index 3c9986e..9cd3766 100644 --- a/README.md +++ b/README.md @@ -1,39 +1,16 @@ -# Attribute Endpoints Provider - Export User Attributes +# Attribute Endpoints Provider -This is a Keycloak Provider that exports user profile attribute values. -The selection of attributes and authorization is manage through an endpoint configuration. +This is a Keycloak Provider that exports an anonymized list of user profile attribute values. +For this it will provide API endpoints for every configured attribute-group. +The configuration of the provider is possible via an admin page. -## Usage - -The provider adds an object type "Attribute Endpoints" to the Keycloak admin website. -You configure the provider by creating one or more endpoint configurations. - -Each endpoint configuration requires: -- a name that is the reference in the endpoint URL (slug) -- the name of a role that the calling user must have to be allowed to query this endpoint -- the name of an attribute or an attribute group that should be exported -- the name of a role that users must have to be included in the list -- an optional regular expression that must match to have a value included -- whether to default to the user email if the attribute is empty - -> **Note** The attribute (group) and the roles need to exist before you can create the endpoint configuration. - -There are two endpoints returning JSON: -- `export/slug`: collate all attribute values into a single list -- `export/slug/map`: produce a map of lists, with the key being the attribute name - -No other data is included in the response, in particular, there is no information on which attribute value is associated with which user. - -User Attribute values can be single or multi-value; the resulting list will include them as a flattened list. - -> **⚠️ Note** The authorization and the selection of the user attributes are not tied together in any way. -> Every user that has the matching role will have all the attributes included that are specified in the endpoint configuration. -> In other words, if you are exporting an attribute group, all attributes will be included. - -> **⚠️ Note** Keycloak has no concept of authorization for individual user attributes (for example, based on assigned roles). -> Users will be able to see and edit any attribute that has been made available to users, irrespective of whether a user would -> be included in an endpoint configuration export or not. +Every endpoint responds with a list of all attribute values, that: +- are in the attribute group matching `attribute-group` +- match an optional RegEx Pattern `attribute-regex` +- belong to a user with a role matching `match-role` +- are non-empty +Multivalue attributes are flattened in the response. ## Building @@ -43,8 +20,79 @@ Once all dependencies are met, simply call `make` to build the provider, which s There's also `make clean` available for removing the output directory. -To add the provider to your Keycloak install, copy `attribute-endpoints-provider/target/attribute-endpoints-provider-1.0-SNAPSHOT.jar` to the Keycloak Provider directory (`/opt/keycloak/providers/). - ## Testing Setup See [testing/README.md](testing/README.md) for details on the Docker Compose based setup that includes a realm and the ability to attach a debugger to the running Keycloak. + +## Example Setup + +We assume an unconfigured, fresh Keycloak installation running under `http://localhost:8080`. +(This can be achieved by running the provided `compose.yaml` after building the provider as outlined in [Building](#building).) + + 1. Add a new realm + e.g. "TestRealm" + 2. Under `Realm Settings > User profile > Attributes Group`, add a new attribute Group + Example: + - `Name` = `"my-attributes-group"` + - `Display name` = `"Endpoint Attributes"` + - `Display description` = `"Attributes exported by the provider."` + 3. Under `Realm Settings > User profile > Attributes`, add a new attribute + Example: + - `Attribute [Name]` = `"ssh-keys"` + - `Display name ` = `"SSH Keys"` + - `Multivalued` = `On` + - `Attribute group` = `"my-attributes-group"` + - `Who can edit?` = `user, admin` + - `Validators` + You can add validators, which will limit what values the user can enter. These validators are ignored by the provider. + 4. Under `Realm roles`, add two new roles + Example: + 1. `Role name` = `"myattribute-match"` + 2. `Role name` = `"myattribute-export"` + 5. Under `Users`, add a new user + Example: + - `Username` = `"user"` + - `Email` = `"user@example.com"` + - `First name` = `"User"` + - `Last name` = `"User"` + - `SSH Keys` = `"example-value-1", "example-value-2"` + 6. In the Settings of the newly created user, go to `Role mapping > Assing role > Realm roles` and check the role `myattribute-match` + 7. create a second user to use the provider + - `Username` = `"bot-user"` + - `Email` = `"bot@example.com"` + - `First name` = `"Bot"` + - `Last name` = `"Bot"` + - After creating: + - give it the role `myattribute-export` + - set a password in the users settings `Creadentials > Set password`. For Example `"password"` +8. Under `Attribute Endpoints > Create item`, add a new endpoint to the provider + Example: + - `Slug` = `"ssh_keys"` + - `Attribute Group` = `"my-attributes-group"` + - `Match Role` = `"myattribute-match"` + - `Auth Role` = `"myattribute-export"` + - `Attribute RegEx` = `".*"` +9. Aquire an OIDC Access Token: + ```shell + curl --request POST \ + --url http://localhost:8080/realms/TestRealm/protocol/openid-connect/token \ + --header 'content-type: application/x-www-form-urlencoded' \ + --data scope=openid \ + --data username=bot-user \ + --data password=password \ + --data grant_type=password \ + --data client_id=admin-cli + ``` +10. copy the value of the response key `access_token` and use it in a second request: + ```shell + curl --request GET \ + --url http://localhost:8080/realms/TestRealm/attribute-endpoints-provider/export/ssh_keys \ + --header 'authorization: Bearer ey...' \ + --header 'content-type: application/json' + ``` +11. You should get a response like this: + ```json + ["example-value-1","example-value-2"] + ``` + +Although this example uses a simple bot account to authenticate to Keycloak, we recommend using a client with service account, when using this provider programmatically. diff --git a/attribute-endpoints-provider/pom.xml b/attribute-endpoints-provider/pom.xml index c525026..a6d1663 100644 --- a/attribute-endpoints-provider/pom.xml +++ b/attribute-endpoints-provider/pom.xml @@ -28,19 +28,6 @@ test - - org.mockito - mockito-core - 5.23.0 - test - - - - org.jboss.resteasy - resteasy-core - test - - org.keycloak keycloak-server-spi-private diff --git a/attribute-endpoints-provider/src/main/java/de/ccc/hamburg/keycloak/attribute_endpoints/AdminUiPage.java b/attribute-endpoints-provider/src/main/java/de/ccc/hamburg/keycloak/attribute_endpoints/AdminUiPage.java index eec6aa1..cfd26b6 100644 --- a/attribute-endpoints-provider/src/main/java/de/ccc/hamburg/keycloak/attribute_endpoints/AdminUiPage.java +++ b/attribute-endpoints-provider/src/main/java/de/ccc/hamburg/keycloak/attribute_endpoints/AdminUiPage.java @@ -1,12 +1,15 @@ package de.ccc.hamburg.keycloak.attribute_endpoints; -import com.google.auto.service.AutoService; +import java.util.List; +import java.util.regex.Pattern; + import org.keycloak.Config; import org.keycloak.component.ComponentModel; import org.keycloak.component.ComponentValidationException; import org.keycloak.models.KeycloakSession; import org.keycloak.models.KeycloakSessionFactory; import org.keycloak.models.RealmModel; +import org.keycloak.models.RoleModel; import org.keycloak.provider.ProviderConfigProperty; import org.keycloak.provider.ProviderConfigurationBuilder; import org.keycloak.representations.userprofile.config.UPConfig; @@ -14,8 +17,7 @@ import org.keycloak.services.ui.extend.UiPageProvider; import org.keycloak.services.ui.extend.UiPageProviderFactory; import org.keycloak.userprofile.UserProfileProvider; -import java.util.List; -import java.util.regex.Pattern; +import com.google.auto.service.AutoService; /** * Implements UiPageProvider to show a config page in the admin @@ -41,7 +43,6 @@ public class AdminUiPage implements UiPageProvider, UiPageProviderFactory - a.getName().equals(configAttributeGroup) - || (a.getGroup() != null && a.getGroup().equals(configAttributeGroup)))) { + } else if (!upconfig.getGroups().stream().anyMatch(g -> g.getName().equals(configAttributeGroup))) { hasError = true; - errorString += " • [Attribute Group] no matching Attribute or Attribute Group\n"; + errorString += " • [Attribute Group] does not exist\n"; } String configAttributeRegex = model.getConfig().getFirst("attribute-regex"); - boolean regexIsBlank = configAttributeRegex == null; + Boolean regexIsBlank = configAttributeRegex == null; if (!regexIsBlank) { try { @@ -114,47 +113,40 @@ public class AdminUiPage implements UiPageProvider, UiPageProviderFactory attribute_list = ctx.users + List componentList = realm.getComponentsStream() + .filter(c -> c.getProviderId().equals(AdminUiPage.PROVIDER_ID)) + .filter(c -> c.getConfig().getFirst("slug").equals(slug)) + .toList(); + + Auth auth = AttributeEndpointsResourceProvider.getAuth(session); + + if (componentList.isEmpty()) { + throw new NotFoundException("Endpoint not found."); + } + + if (componentList.size() > 1) { + throw new NotFoundException( + "Endpoint Configuration Error - Multiple configurations exist for this endpoint."); + } + + ComponentModel component = componentList.get(0); + + String configAuthRole = component.getConfig().getFirst("auth-role"); + RoleModel authRole = realm.getRole(configAuthRole); + if (authRole == null) { + throw new ServerErrorException("Endpoint Configuration Error - auth-role does not exist.", 500); + } + + String configMatchRole = component.getConfig().getFirst("match-role"); + RoleModel matchRole = realm.getRole(configMatchRole); + if (matchRole == null) { + throw new ServerErrorException("Endpoint Configuration Error - match-role does not exist.", 500); + } + + UserProfileProvider profileProvider = session.getProvider(UserProfileProvider.class); + UPConfig upconfig = profileProvider.getConfiguration(); + String configAttributeGroup = component.getConfig().getFirst("attribute-group"); + if (!upconfig.getGroups().stream().anyMatch(g -> g.getName().equals(configAttributeGroup))) { + throw new ServerErrorException("Endpoint Configuration Error - attribute-group does not exist.", 500); + } + + String configAttributeRegex = component.getConfig().getFirst("attribute-regex"); + Boolean regexIsBlank = configAttributeRegex == null; + + if (!regexIsBlank) { + try { + Pattern.compile(configAttributeRegex); + } catch (Exception e) { + throw new ServerErrorException( + "Endpoint Configuration Error - attribute-regex is not a valid regex pattern.", 500); + } + } + + UserModel authUser = auth.getUser(); + if (!authUser.hasRole(authRole)) { + LOG.info("User " + authUser.getUsername() + " does not have required role " + authRole.getName()); + throw new ForbiddenException("User does not have required auth role."); + } + + List attributeNames = upconfig.getAttributes() + .stream() + .filter(a -> a.getGroup() != null && a.getGroup().equals(configAttributeGroup)) + .map(a -> a.getName()) + .toList(); + + UserProvider userProvider = session.users(); + Stream users = userProvider.searchForUserStream(realm, Map.of()) + .filter(user -> user.hasRole(matchRole)); + + List attribute_list = users .map(user -> { - Stream attributeStream = ctx.attributeNames.stream(); - - attributeStream = attributeStream.map(attributeName -> ctx.MapUserAttribute(user, attributeName).toList()) + Stream attributeStream = attributeNames.stream() + .map(attributeName -> user.getAttributeStream(attributeName).toList()) .flatMap(Collection::stream); return attributeStream @@ -62,137 +134,18 @@ public class AttributeEndpointsResourceProvider implements RealmResourceProvider .toList(); }) .flatMap(List::stream) - .filter(ctx.filter::matches) + .filter(attribute -> { + if (regexIsBlank) { + return true; + } + final Pattern pattern = Pattern.compile(configAttributeRegex); + final Matcher matcher = pattern.matcher(attribute); + return matcher.find(); + }) .toList(); return Response.ok(attribute_list).build(); - } - /** - * Return a map of lists of attribute values. For each attribute in the named attribute - * group, add an entry in the resulting map with the attribute name as the key, and the - * values as a list as the values. - * - * @param attributeGroupName attribute group name - * @return a map of attribute names and their values - */ - @GET - @Path("export/{attributeGroupName}/map") - @Produces(MediaType.APPLICATION_JSON) - public Response exportAttributeValuesMap(@PathParam("attributeGroupName") String attributeGroupName) { - AttributeExportContext ctx = new AttributeExportContext(attributeGroupName); - - List userList = ctx.users.toList(); - - Map> attributeMap = ctx.attributeNames.stream() - .collect(Collectors.toMap( - attributeName -> attributeName, - attributeName -> userList.stream() - .flatMap(user -> ctx.MapUserAttribute(user, attributeName)) - .filter(attribute -> !attribute.isEmpty()) - .filter(ctx.filter::matches) - .toList())); - - return Response.ok(attributeMap).build(); - } - - - /** - * Resolves and validates the configuration and request state needed to export attribute - * values for a given slug, exposing the results as member variables. - */ - private class AttributeExportContext { - final Pattern validEmail = Pattern.compile("@"); - - List attributeNames; - UserModel authUser; - String configAttributeGroup; - boolean defaultToUserEmail; - RegExFilter filter; - UPConfig upconfig; - Stream users; - - AttributeExportContext(String slug) { - RealmModel realm = session.getContext().getRealm(); - - List componentList = realm.getComponentsStream() - .filter(c -> c.getProviderId().equals(AdminUiPage.PROVIDER_ID)) - .filter(c -> c.getConfig().getFirst("slug").equals(slug)) - .toList(); - - if (componentList.isEmpty()) { - throw new NotFoundException("Attribute Endpoint " + slug + " not found"); - } - - if (componentList.size() > 1) { - throw new NotFoundException( - "Attribute Endpoint Configuration Error - Multiple configurations exist for " + slug); - } - - ComponentModel component = componentList.get(0); - - RoleModel authRole = realm.getRole(component.getConfig().getFirst("auth-role")); - if (authRole == null) { - throw new ServerErrorException("Attribute Endpoint " + slug + " Configuration Error - auth-role does not exist.", 500); - } - - RoleModel matchRole = realm.getRole(component.getConfig().getFirst("match-role")); - if (matchRole == null) { - throw new ServerErrorException("Attribute Endpoint " + slug + " Configuration Error - match-role does not exist.", 500); - } - - upconfig = session.getProvider(UserProfileProvider.class).getConfiguration(); - configAttributeGroup = component.getConfig().getFirst("attribute-group"); - if (upconfig.getGroups().stream().noneMatch(g -> g.getName().equals(configAttributeGroup)) && - upconfig.getAttributes().stream().noneMatch(a -> a.getName().equals(configAttributeGroup))) { - throw new ServerErrorException("Attribute Endpoint " + slug + " Configuration Error - no attribute or attribute group named " + configAttributeGroup + " found", 500); - } - - try { - filter = new RegExFilter(component.getConfig().getFirst("attribute-regex")); - } catch (Exception e) { - throw new ServerErrorException( - "Attribute Endpoint " + slug + " Configuration Error - attribute-regex is not a valid regex pattern.", 500); - } - - authUser = AttributeEndpointsResourceProvider.getAuth(session).getUser(); - if (!authUser.hasRole(authRole)) { - LOG.info("User " + authUser.getUsername() + " does not have required role " + authRole.getName() + " for attribute endpoint " + slug); - throw new ForbiddenException("User does not have required auth role."); - } - - // select all attributes that match configAttributeGroup, or that are in a group that matches configAttributeGroup - attributeNames = upconfig.getAttributes() - .stream() - .filter(a -> - a.getName().equals(configAttributeGroup) - || (a.getGroup() != null && a.getGroup().equals(configAttributeGroup))) - .map(UPAttribute::getName) - .toList(); - - UserProvider userProvider = session.users(); - users = userProvider.searchForUserStream(realm, Map.of()) - .filter(user -> user.hasRole(matchRole)); - defaultToUserEmail = Boolean.parseBoolean(component.getConfig().getFirstOrDefault("default-to-user-email", "false")); - } - - /** - * If defaultToUserEmail is set, default to user email if no attribute exists, and remove any value that is not - * a valid email address. - * - * @param user the user whose attributes are being exported - * @param attributeName the attribute to export - * @return a stream of attribute values - */ - Stream MapUserAttribute(UserModel user, String attributeName) { - if (defaultToUserEmail) { - // need to load everything otherwise we can't check for non-existent attribute - Map> attrs = user.getAttributes(); - return attrs.getOrDefault(attributeName, - List.of(user.getEmail())).stream().filter(v -> !validEmail.matcher(v).matches()); - } - return user.getAttributeStream(attributeName); - } } private static Auth getAuth(KeycloakSession session) { @@ -203,25 +156,8 @@ public class AttributeEndpointsResourceProvider implements RealmResourceProvider } RealmModel realm = session.getContext().getRealm(); - ClientModel client = auth.client(); - return new Auth(realm, auth.token(), auth.user(), client, auth.session(), false); - } - - private static class RegExFilter { - Pattern pattern; - - RegExFilter(String regex) { - if (regex == null) - pattern = null; - else - pattern = Pattern.compile(regex); - } - - boolean matches(String input) { - if (pattern == null) - return true; - return pattern.matcher(input).matches(); - } + ClientModel client = auth.getClient(); + return new Auth(realm, auth.getToken(), auth.getUser(), client, auth.getSession(), false); } } diff --git a/attribute-endpoints-provider/src/test/java/de/ccc/hamburg/keycloak/attribute_endpoints/AttributeEndpointsResourceProviderTest.java b/attribute-endpoints-provider/src/test/java/de/ccc/hamburg/keycloak/attribute_endpoints/AttributeEndpointsResourceProviderTest.java deleted file mode 100644 index 559f208..0000000 --- a/attribute-endpoints-provider/src/test/java/de/ccc/hamburg/keycloak/attribute_endpoints/AttributeEndpointsResourceProviderTest.java +++ /dev/null @@ -1,317 +0,0 @@ -package de.ccc.hamburg.keycloak.attribute_endpoints; - -import jakarta.ws.rs.ForbiddenException; -import jakarta.ws.rs.NotFoundException; -import jakarta.ws.rs.ServerErrorException; -import jakarta.ws.rs.core.Response; -import org.junit.Before; -import org.junit.Test; -import org.keycloak.component.ComponentModel; -import org.keycloak.models.*; -import org.keycloak.representations.userprofile.config.UPAttribute; -import org.keycloak.representations.userprofile.config.UPConfig; -import org.keycloak.representations.userprofile.config.UPGroup; -import org.keycloak.services.managers.AppAuthManager; -import org.keycloak.services.managers.AuthenticationManager.AuthResult; -import org.keycloak.userprofile.UserProfileProvider; -import org.mockito.MockedConstruction; -import org.mockito.Mockito; - -import java.util.Collections; -import java.util.HashMap; -import java.util.List; -import java.util.Map; -import java.util.function.Supplier; -import java.util.stream.Stream; - -import static org.junit.Assert.assertEquals; -import static org.junit.Assert.assertThrows; -import static org.junit.Assert.assertTrue; -import static org.mockito.ArgumentMatchers.*; -import static org.mockito.Mockito.mock; -import static org.mockito.Mockito.when; - -/** - * Tests the two endpoints of {@link AttributeEndpointsResourceProvider} against the realm - * configuration and expected results documented in {@code testing/README.md}. - */ -public class AttributeEndpointsResourceProviderTest { - - private static final String SSH_KEY_1 = "ssh-key-1"; - private static final String SSH_KEY_2 = "ssh-key-2"; - private static final String MAILING_LIST_CHAOS = "mailing-list-address-chaos"; - private static final String MAILING_LIST_INTERN = "mailing-list-address-intern"; - - private KeycloakSession session; - private RealmModel realm; - private Map roles; - private UserModel hacker; - private UserModel tester; - private UserModel noone; - - @Before - public void setUp() { - session = mock(KeycloakSession.class); - KeycloakContext context = mock(KeycloakContext.class); - when(session.getContext()).thenReturn(context); - - realm = mock(RealmModel.class); - when(context.getRealm()).thenReturn(realm); - - roles = new HashMap<>(); - for (String name : List.of("dooris-authorized", "export-dooris-ssh-keys", - "mailing-list-chaos-member", "mailing-list-intern-member", - "export-mailing-list-addresses")) { - roles.put(name, mock(RoleModel.class)); - } - when(realm.getRole(anyString())).thenAnswer(inv -> roles.get(inv.getArgument(0, String.class))); - - List components = List.of( - attributeEndpointComponent("dooris-ssh-keys", - "export-dooris-ssh-keys", "dooris-authorized", "dooris-ssh-keys", - false), - attributeEndpointComponent("mailing-list-addresses-chaos", - "export-mailing-list-addresses", "mailing-list-chaos-member", MAILING_LIST_CHAOS, - true), - attributeEndpointComponent("mailing-list-addresses-intern", - "export-mailing-list-addresses", "mailing-list-intern-member", MAILING_LIST_INTERN, - true)); - when(realm.getComponentsStream()).thenAnswer(inv -> components.stream()); - - UserProfileProvider userProfileProvider = mock(UserProfileProvider.class); - when(session.getProvider(UserProfileProvider.class)).thenReturn(userProfileProvider); - when(userProfileProvider.getConfiguration()).thenReturn(testUserProfileConfig()); - - hacker = user("hacker", "hacker@example.net", Map.of( - SSH_KEY_1, List.of("hacker-ssh-key-1"), - SSH_KEY_2, List.of("hacker-ssh-key-2"), - MAILING_LIST_INTERN, List.of("hacker+intern@example.net")), - List.of("dooris-authorized", "mailing-list-chaos-member", "mailing-list-intern-member")); - tester = user("tester", "tester@example.com", Map.of( - SSH_KEY_1, List.of("tester-ssh-key-1"), - SSH_KEY_2, List.of("tester-ssh-key-2"), - MAILING_LIST_CHAOS, List.of("tester+chaos@example.com"), - MAILING_LIST_INTERN, List.of("tester+intern@example.com")), - List.of("mailing-list-chaos-member")); - noone = user("noone", "noone@example.org", Map.of( - SSH_KEY_1, List.of("noone-ssh-key-1"), - SSH_KEY_2, List.of("noone-ssh-key-2"), - MAILING_LIST_CHAOS, List.of("noone+chaos@example.org"), - MAILING_LIST_INTERN, List.of("noone+intern@example.org", "-")), - Collections.emptyList()); - - UserProvider userProvider = mock(UserProvider.class); - when(session.users()).thenReturn(userProvider); - when(userProvider.searchForUserStream(eq(realm), eq(Map.of()))) - .thenAnswer(inv -> Stream.of(hacker, tester, noone)); - } - - @Test - public void exportAttributeValues_doorisSlug_returnsSshKeysOfMatchingUser() { - try (Response response = callAuthenticatedAs("export-dooris-ssh-keys", - () -> new AttributeEndpointsResourceProvider(session).exportAttributeValues("dooris-ssh-keys"))) { - - assertEquals(200, response.getStatus()); - assertEquals(List.of("hacker-ssh-key-1", "hacker-ssh-key-2"), response.getEntity()); - } - } - - @Test - public void exportAttributeValuesMap_doorisSlug_returnsSshKeysPerAttribute() { - try (Response response = callAuthenticatedAs("export-dooris-ssh-keys", - () -> new AttributeEndpointsResourceProvider(session).exportAttributeValuesMap("dooris-ssh-keys"))) { - - assertEquals(200, response.getStatus()); - assertEquals(Map.of( - SSH_KEY_1, List.of("hacker-ssh-key-1"), - SSH_KEY_2, List.of("hacker-ssh-key-2")), - response.getEntity()); - } - } - - @Test - public void exportAttributeValues_mailingListChaosSlug_returnsAddressesOfAllMatchingUsers() { - try (Response response = callAuthenticatedAs("export-mailing-list-addresses", - () -> new AttributeEndpointsResourceProvider(session) - .exportAttributeValues("mailing-list-addresses-chaos"))) { - - assertEquals(200, response.getStatus()); - assertEquals(List.of("hacker@example.net", "tester+chaos@example.com"), response.getEntity()); - } - } - - @Test - public void exportAttributeValues_mailingListInternSlug_returnsAddressOfSingleMatchingUser() { - try (Response response = callAuthenticatedAs("export-mailing-list-addresses", - () -> new AttributeEndpointsResourceProvider(session) - .exportAttributeValues("mailing-list-addresses-intern"))) { - - assertEquals(200, response.getStatus()); - assertEquals(List.of("hacker+intern@example.net"), response.getEntity()); - } - } - - @Test - public void exportAttributeValuesMap_mailingListChaosSlug_returnsAddressesPerAttribute() { - try (Response response = callAuthenticatedAs("export-mailing-list-addresses", - () -> new AttributeEndpointsResourceProvider(session) - .exportAttributeValuesMap("mailing-list-addresses-chaos"))) { - - assertEquals(200, response.getStatus()); - assertEquals(Map.of(MAILING_LIST_CHAOS, - List.of("hacker@example.net", "tester+chaos@example.com")), - response.getEntity()); - } - } - - @Test - public void exportAttributeValues_unknownSlug_throwsNotFound() { - NotFoundException exception = assertThrows(NotFoundException.class, - () -> callAuthenticatedAs("export-dooris-ssh-keys", - () -> new AttributeEndpointsResourceProvider(session).exportAttributeValues("unknown-slug"))); - - assertEquals(404, exception.getResponse().getStatus()); - assertTrue(exception.getMessage().contains("not found")); - } - - @Test - public void exportAttributeValues_duplicateSlugConfiguration_throwsNotFound() { - List duplicateComponents = List.of( - attributeEndpointComponent("duplicate-slug", - "export-dooris-ssh-keys", "dooris-authorized", "dooris-ssh-keys", - false), - attributeEndpointComponent("duplicate-slug", - "export-dooris-ssh-keys", "dooris-authorized", "dooris-ssh-keys", - false)); - when(realm.getComponentsStream()).thenAnswer(inv -> duplicateComponents.stream()); - - NotFoundException exception = assertThrows(NotFoundException.class, - () -> callAuthenticatedAs("export-dooris-ssh-keys", - () -> new AttributeEndpointsResourceProvider(session).exportAttributeValues("duplicate-slug"))); - - assertEquals(404, exception.getResponse().getStatus()); - assertTrue(exception.getMessage().contains("Multiple configurations exist")); - } - - @Test - public void exportAttributeValues_missingAuthRole_throwsServerError() { - List components = List.of( - attributeEndpointComponent("bad-auth-role", - "nonexistent-role", "dooris-authorized", "dooris-ssh-keys", - false)); - when(realm.getComponentsStream()).thenAnswer(inv -> components.stream()); - - ServerErrorException exception = assertThrows(ServerErrorException.class, - () -> callAuthenticatedAs("export-dooris-ssh-keys", - () -> new AttributeEndpointsResourceProvider(session).exportAttributeValues("bad-auth-role"))); - - assertEquals(500, exception.getResponse().getStatus()); - assertTrue(exception.getMessage().contains("auth-role does not exist")); - } - - @Test - public void exportAttributeValues_missingMatchRole_throwsServerError() { - List components = List.of( - attributeEndpointComponent("bad-match-role", - "export-dooris-ssh-keys", "nonexistent-role", "dooris-ssh-keys", - false)); - when(realm.getComponentsStream()).thenAnswer(inv -> components.stream()); - - ServerErrorException exception = assertThrows(ServerErrorException.class, - () -> callAuthenticatedAs("export-dooris-ssh-keys", - () -> new AttributeEndpointsResourceProvider(session).exportAttributeValues("bad-match-role"))); - - assertEquals(500, exception.getResponse().getStatus()); - assertTrue(exception.getMessage().contains("match-role does not exist")); - } - - @Test - public void exportAttributeValues_invalidAttributeRegex_throwsServerError() { - ComponentModel component = attributeEndpointComponent("bad-regex", - "export-dooris-ssh-keys", "dooris-authorized", "dooris-ssh-keys", - false); - component.put("attribute-regex", "["); - when(realm.getComponentsStream()).thenAnswer(inv -> Stream.of(component)); - - ServerErrorException exception = assertThrows(ServerErrorException.class, - () -> callAuthenticatedAs("export-dooris-ssh-keys", - () -> new AttributeEndpointsResourceProvider(session).exportAttributeValues("bad-regex"))); - - assertEquals(500, exception.getResponse().getStatus()); - assertTrue(exception.getMessage().contains("attribute-regex is not a valid regex pattern")); - } - - @Test - public void exportAttributeValues_callerMissingAuthRole_throwsForbidden() { - ForbiddenException exception = assertThrows(ForbiddenException.class, - () -> callAuthenticatedAs("not-a-configured-role", - () -> new AttributeEndpointsResourceProvider(session).exportAttributeValues("dooris-ssh-keys"))); - - assertEquals(403, exception.getResponse().getStatus()); - } - - /** - * Runs {@code call} as if authenticated by a bearer token belonging to a service account - * that holds {@code requiredRole}, by intercepting construction of the - * {@link AppAuthManager.BearerTokenAuthenticator} the provider creates internally. - */ - private Response callAuthenticatedAs(String requiredRole, Supplier call) { - UserModel serviceAccount = mock(UserModel.class); - when(serviceAccount.hasRole(roles.get(requiredRole))).thenReturn(true); - - try (MockedConstruction ignored = Mockito.mockConstruction( - AppAuthManager.BearerTokenAuthenticator.class, - (mock, ctx) -> when(mock.authenticate()) - .thenReturn(new AuthResult(serviceAccount, null, null, null)))) { - return call.get(); - } - } - - private static ComponentModel attributeEndpointComponent(String slug, String authRole, String matchRole, - String attributeGroup, boolean defaultToUserEmail) { - ComponentModel component = new ComponentModel(); - component.setProviderId(AdminUiPage.PROVIDER_ID); - component.put("slug", slug); - component.put("auth-role", authRole); - component.put("match-role", matchRole); - component.put("attribute-group", attributeGroup); - component.put("default-to-user-email", Boolean.toString(defaultToUserEmail)); - return component; - } - - /** - * Mirrors the User Profile configuration in testing. - */ - private static UPConfig testUserProfileConfig() { - UPConfig upConfig = new UPConfig(); - upConfig.setGroups(List.of(new UPGroup("dooris-ssh-keys"), new UPGroup("mailing-list-addresses"))); - upConfig.setAttributes(List.of( - attribute(SSH_KEY_1, "dooris-ssh-keys"), - attribute(SSH_KEY_2, "dooris-ssh-keys"), - attribute(MAILING_LIST_CHAOS, "mailing-list-addresses"), - attribute(MAILING_LIST_INTERN, "mailing-list-addresses"))); - return upConfig; - } - - private static UPAttribute attribute(String name, String group) { - UPAttribute attribute = new UPAttribute(name); - attribute.setGroup(group); - return attribute; - } - - private UserModel user(String username, String email, Map> attributes, List roleNames) { - UserModel user = mock(UserModel.class); - when(user.getUsername()).thenReturn(username); - when(user.getEmail()).thenReturn(email.isBlank() ? null : email); - when(user.getAttributes()).thenReturn(attributes); - - when(user.getAttributeStream(anyString())).thenAnswer(inv -> Stream.empty()); - attributes.forEach((name, value) -> - when(user.getAttributeStream(eq(name))).thenAnswer(inv -> value.stream())); - - when(user.hasRole(any(RoleModel.class))).thenReturn(false); - roleNames.forEach(name -> when(user.hasRole(roles.get(name))).thenReturn(true)); - - return user; - } -} diff --git a/testing/README.md b/testing/README.md index 7a16c0e..2c5600e 100644 --- a/testing/README.md +++ b/testing/README.md @@ -1,11 +1,9 @@ -# Integration Testing - -This directory contains infrastructure and tests to verify end-to-end operation of the provider. - -## Creating a Testing Keycloak +# Creating a Testing Keycloak The Docker Compose setup in this directory sets up Keycloak and imports a realm `testing`. +## Starting Keycloak + Run `docker compose up -d` to start Keycloak. The admin console will be available at http://localhost:8080/. You can attach a Java debugger at `localhost:8081`. @@ -13,7 +11,7 @@ You can attach a Java debugger at `localhost:8081`. The realm export is in `import/testing.json`. It will be imported automatically when Keycloak starts. -### Updating the Realm +## Updating the Realm If you want to make changes to the testing realm and persist them, you need to export the realm. @@ -27,36 +25,16 @@ docker compose exec -it keycloak sh -c "cp -rp /opt/keycloak/data/h2 /tmp && env ## Running Integration Tests -This directory contains shell scripts that exercise the attribute endpoint. +This directory also contains shell scripts that exercise the attribute endpoint. Bring up Keycloak with `docker compose up -d`, then run one of the `client-test-export-`*`.sh` scripts. ```shell $ ./client-test-export-dooris.sh -All attributes collated into a single list [ "hacker-ssh-key-1", "hacker-ssh-key-2" ] -Results mapped per attribute -{ - "ssh-key-1": [ - "hacker-ssh-key-1" - ], - "ssh-key-2": [ - "hacker-ssh-key-2" - ] -} -$ ./client-test-export-mailing-lists.sh -chaos@ -[ - "hacker+chaos@example.net", - "tester+chaos@example.com" -] -intern@ -[ - "hacker+intern@example.net" -] ``` ## Realm `testing` Configuration @@ -65,16 +43,16 @@ The realm contains these objects: * Clients: * `export-dooris-ssh-keys` with secret `export-dooris-ssh-keys-secret` and user `service-account-export-dooris-ssh-keys` - * `export-mailing-list-addresses` with secret `export-mailing-list-addresses-secret` and user `service-account-export-mailing-list-addresses` + * `export-mailing-list-addresses` with secret `export-mailing-list-addresses-secret` and role `export-mailing-list-addresses` * Realm Roles: - * `dooris-authorized` to assign to users whose SSH keys should be exported - * `mailing-list-chaos-member` to assign to users who are a member of the chaos mailing list - * `mailing-list-intern-member` to assign to users who are a member of the intern mailing list - * `export-dooris-ssh-keys` to assign to service account users that should be allowed to use the dooris endpoint config - * `export-mailing-list-addresses` to assign to service account users that should be allowed to use the mailing list endpoint configs + * `dooris-authorized` + * `mailing-list-chaos-member` + * `mailing-list-intern-member` + * `export-dooris-ssh-keys` + * `export-mailing-list-addresses` * Groups: * `chaos` with role `mailing-list-chaos-member` - * `ìntern` with roles `dooris-authorized`, `mailing-list-chaos-member` and `mailing-list-intern-member` + * `ìntern` with roles `dooris-authorized` and `mailing-list-intern-member` * Users: * `tester` (Tony Tester), email `tester@example.com`, member of group `chaos` * Mailing List Addresses: @@ -103,7 +81,7 @@ The realm contains these objects: * `mailing-list-address-chaos` * Attribute Group `mailing-list-addresses` * `mailing-list-address-intern` - * Attribute Group `mailing-list-addresses` + * Attribute Group `mailing-list-intern` * `ssh-key-1` * Attribute Group `dooris-ssh-keys` * `ssh-key-2` diff --git a/testing/client-test-export-dooris.sh b/testing/client-test-export-dooris.sh index 82f5ad3..b6d4696 100755 --- a/testing/client-test-export-dooris.sh +++ b/testing/client-test-export-dooris.sh @@ -7,21 +7,14 @@ set -e ACCESS_TOKEN="$(curl -s --request POST \ - --url http://localhost:8080/realms/testing/protocol/openid-connect/token \ - --header 'content-type: application/x-www-form-urlencoded' \ - --data scope=openid \ - --data client_id=export-dooris-ssh-keys \ - --data client_secret=export-dooris-ssh-keys-secret \ - --data grant_type=client_credentials | jq --raw-output .access_token -)" + --url http://localhost:8080/realms/testing/protocol/openid-connect/token \ + --header 'content-type: application/x-www-form-urlencoded' \ + --data scope=openid \ + --data client_id=export-dooris-ssh-keys \ + --data client_secret=export-dooris-ssh-keys-secret \ + --data grant_type=client_credentials | jq --raw-output .access_token -)" -echo "All attributes collated into a single list" curl -s --request GET \ - --url http://localhost:8080/realms/testing/attribute-endpoints-provider/export/dooris-ssh-keys \ - --header "authorization: Bearer ${ACCESS_TOKEN}" \ - --header "content-type: application/json" | jq . - - -echo "Results mapped per attribute" -curl -s --request GET \ - --url http://localhost:8080/realms/testing/attribute-endpoints-provider/export/dooris-ssh-keys/map \ - --header "authorization: Bearer ${ACCESS_TOKEN}" \ - --header "content-type: application/json" | jq . - + --url http://localhost:8080/realms/testing/attribute-endpoints-provider/export/dooris-ssh-keys \ + --header "authorization: Bearer ${ACCESS_TOKEN}" \ + --header "content-type: application/json" | jq . - \ No newline at end of file diff --git a/testing/client-test-export-mailing-lists.sh b/testing/client-test-export-mailing-lists.sh deleted file mode 100755 index 4f15d76..0000000 --- a/testing/client-test-export-mailing-lists.sh +++ /dev/null @@ -1,27 +0,0 @@ -#!/bin/sh - -# -# Use curl to run a test export of Dooris ssh keys -# - -set -e - -ACCESS_TOKEN="$(curl -s --request POST \ - --url http://localhost:8080/realms/testing/protocol/openid-connect/token \ - --header 'content-type: application/x-www-form-urlencoded' \ - --data scope=openid \ - --data client_id=export-mailing-list-addresses \ - --data client_secret=export-mailing-list-addresses-secret \ - --data grant_type=client_credentials | jq --raw-output .access_token -)" - -echo "chaos@" -curl -s --request GET \ - --url http://localhost:8080/realms/testing/attribute-endpoints-provider/export/mailing-list-addresses-chaos \ - --header "authorization: Bearer ${ACCESS_TOKEN}" \ - --header "content-type: application/json" | jq . - - -echo "intern@" -curl -s --request GET \ - --url http://localhost:8080/realms/testing/attribute-endpoints-provider/export/mailing-list-addresses-intern \ - --header "authorization: Bearer ${ACCESS_TOKEN}" \ - --header "content-type: application/json" | jq . - diff --git a/testing/compose.yaml b/testing/compose.yaml index 3f73478..0311532 100644 --- a/testing/compose.yaml +++ b/testing/compose.yaml @@ -12,17 +12,6 @@ services: ports: - "8080:8080" - "8081:8081" - networks: - - keycloak volumes: - ./import:/opt/keycloak/data/import/ - - ../attribute-endpoints-provider/target/attribute-endpoints-provider-1.0-SNAPSHOT.jar:/opt/keycloak/providers/attribute-endpoints-provider.jar - -networks: - # force a "local" IP address that Keycloak accepts HTTP (not HTTPS) requests from - keycloak: - driver: bridge - ipam: - config: - - subnet: 192.168.231.128/29 - gateway: 192.168.231.129 + - ../attribute-endpoints-provider/target/attribute-endpoints-provider-1.0-SNAPSHOT.jar:/opt/keycloak/providers/attribute-endpoints-provider.jar \ No newline at end of file diff --git a/testing/import/testing.json b/testing/import/testing.json index c4acac3..3744ff8 100644 --- a/testing/import/testing.json +++ b/testing/import/testing.json @@ -447,7 +447,8 @@ "attributes" : { "ssh-key-1" : [ "hacker-ssh-key-1" ], "mailing-list-address-intern" : [ "hacker+intern@example.net" ], - "ssh-key-2" : [ "hacker-ssh-key-2" ] + "ssh-key-2" : [ "hacker-ssh-key-2" ], + "mailing-list-address-chaos" : [ "hacker+chaos@example.net" ] }, "enabled" : true, "createdTimestamp" : 1784376038850, @@ -1477,7 +1478,7 @@ "subType" : "authenticated", "subComponents" : { }, "config" : { - "allowed-protocol-mapper-types" : [ "saml-user-attribute-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-usermodel-property-mapper", "saml-role-list-mapper", "oidc-usermodel-attribute-mapper", "saml-user-property-mapper", "oidc-full-name-mapper", "oidc-address-mapper" ] + "allowed-protocol-mapper-types" : [ "oidc-sha256-pairwise-sub-mapper", "saml-user-attribute-mapper", "saml-user-property-mapper", "oidc-full-name-mapper", "saml-role-list-mapper", "oidc-address-mapper", "oidc-usermodel-attribute-mapper", "oidc-usermodel-property-mapper" ] } }, { "id" : "a49de9bf-462b-4c61-bb52-0373732f4b1b", @@ -1537,7 +1538,7 @@ "subType" : "anonymous", "subComponents" : { }, "config" : { - "allowed-protocol-mapper-types" : [ "saml-user-attribute-mapper", "oidc-usermodel-attribute-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-full-name-mapper", "saml-role-list-mapper", "oidc-usermodel-property-mapper", "oidc-address-mapper", "saml-user-property-mapper" ] + "allowed-protocol-mapper-types" : [ "saml-role-list-mapper", "oidc-address-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-usermodel-attribute-mapper", "oidc-full-name-mapper", "oidc-usermodel-property-mapper", "saml-user-property-mapper", "saml-user-attribute-mapper" ] } }, { "id" : "dd4024e9-f080-4319-aeb7-7f9906c345c5", @@ -1604,9 +1605,8 @@ "subComponents" : { }, "config" : { "match-role" : [ "mailing-list-intern-member" ], - "default-to-user-email" : [ "true" ], "auth-role" : [ "export-mailing-list-addresses" ], - "attribute-group" : [ "mailing-list-address-intern" ], + "attribute-group" : [ "mailing-list-addresses" ], "slug" : [ "mailing-list-addresses-intern" ] } }, { @@ -1615,8 +1615,8 @@ "subComponents" : { }, "config" : { "match-role" : [ "dooris-authorized" ], - "attribute-group" : [ "dooris-ssh-keys" ], "auth-role" : [ "export-dooris-ssh-keys" ], + "attribute-group" : [ "dooris-ssh-keys" ], "slug" : [ "dooris-ssh-keys" ] } }, { @@ -1625,9 +1625,8 @@ "subComponents" : { }, "config" : { "match-role" : [ "mailing-list-chaos-member" ], - "default-to-user-email" : [ "true" ], - "attribute-group" : [ "mailing-list-address-chaos" ], "auth-role" : [ "export-mailing-list-addresses" ], + "attribute-group" : [ "mailing-list-addresses" ], "slug" : [ "mailing-list-addresses-chaos" ] } } ]