diff --git a/.forgejo/workflows/verify.yaml b/.forgejo/workflows/verify.yaml index 9f88d22..be66b11 100644 --- a/.forgejo/workflows/verify.yaml +++ b/.forgejo/workflows/verify.yaml @@ -1,19 +1,17 @@ on: pull_request: push: - branches: - - main jobs: ansible-lint: name: Verify runs-on: docker steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v6 - name: Install maven run: | apt update apt install -y maven - name: Run maven verify run: | - mvn -f attribute-endpoints-provider --batch-mode --no-transfer-progress verify + mvn -f attribute-endpoints-provider verify diff --git a/attribute-endpoints-provider/pom.xml b/attribute-endpoints-provider/pom.xml index a6d1663..61cafbb 100644 --- a/attribute-endpoints-provider/pom.xml +++ b/attribute-endpoints-provider/pom.xml @@ -17,7 +17,7 @@ UTF-8 17 17 - 26.6.0 + 26.7.0 @@ -86,7 +86,7 @@ maven-surefire-plugin - 3.5.6 + 3.5.5 maven-jar-plugin @@ -104,7 +104,7 @@ https://maven.apache.org/ref/current/maven-core/lifecycles.html#site_Lifecycle --> maven-site-plugin - 3.22.0 + 3.21.0 maven-project-info-reports-plugin diff --git a/attribute-endpoints-provider/src/main/java/de/ccc/hamburg/keycloak/attribute_endpoints/AttributeEndpointsResourceProvider.java b/attribute-endpoints-provider/src/main/java/de/ccc/hamburg/keycloak/attribute_endpoints/AttributeEndpointsResourceProvider.java index 15303dc..bd98b30 100644 --- a/attribute-endpoints-provider/src/main/java/de/ccc/hamburg/keycloak/attribute_endpoints/AttributeEndpointsResourceProvider.java +++ b/attribute-endpoints-provider/src/main/java/de/ccc/hamburg/keycloak/attribute_endpoints/AttributeEndpointsResourceProvider.java @@ -109,7 +109,6 @@ public class AttributeEndpointsResourceProvider implements RealmResourceProvider UserModel authUser = auth.getUser(); if (!authUser.hasRole(authRole)) { - LOG.info("User " + authUser.getUsername() + " does not have required role " + authRole.getName()); throw new ForbiddenException("User does not have required auth role."); } diff --git a/testing/README.md b/testing/README.md index 2c5600e..86ff971 100644 --- a/testing/README.md +++ b/testing/README.md @@ -23,26 +23,12 @@ The copying of the database is necessary to avoid locking errors. docker compose exec -it keycloak sh -c "cp -rp /opt/keycloak/data/h2 /tmp && env -i -- /opt/keycloak/bin/kc.sh export --db dev-file --db-url 'jdbc:h2:file:/tmp/h2/keycloakdb;NON_KEYWORDS=VALUE' --file /opt/keycloak/data/import/testing.json --realm testing" ``` -## Running Integration Tests - -This directory also contains shell scripts that exercise the attribute endpoint. - -Bring up Keycloak with `docker compose up -d`, then run one of the `client-test-export-`*`.sh` scripts. - -```shell -$ ./client-test-export-dooris.sh -[ - "hacker-ssh-key-1", - "hacker-ssh-key-2" -] -``` - -## Realm `testing` Configuration +## Testing Realm Configuration The realm contains these objects: * Clients: - * `export-dooris-ssh-keys` with secret `export-dooris-ssh-keys-secret` and user `service-account-export-dooris-ssh-keys` + * `export-dooris-ssh-keys` with secret `export-dooris-ssh-keys-secret` and role `export-dooris-ssh-keys` * `export-mailing-list-addresses` with secret `export-mailing-list-addresses-secret` and role `export-mailing-list-addresses` * Realm Roles: * `dooris-authorized` @@ -68,34 +54,3 @@ The realm contains these objects: * Dooris SSH Keys: * SSH Key 1: `hacker-ssh-key-1` * SSH Key 2: `hacker-ssh-key-2` - * `service-account-export-dooris-ssh-keys` - * Role `export-dooris-ssh-keys` - * `service-account-export-mailing-list-addresses` - * Role `export-mailing-list-addresses` -* Realm Settings: - * User Profile: - * Attribute Groups: - * `dooris-ssh-keys` - * `mailing-list-addresses` - * Attributes: - * `mailing-list-address-chaos` - * Attribute Group `mailing-list-addresses` - * `mailing-list-address-intern` - * Attribute Group `mailing-list-intern` - * `ssh-key-1` - * Attribute Group `dooris-ssh-keys` - * `ssh-key-2` - * Attribute Group `dooris-ssh-keys` -* Custom Attributes: - * Slug `dooris-ssh-keys` - * Attribute Group `dooris-ssh-keys` - * Match Role `dooris-authorized` - * Auth Role `export-dooris-ssh-keys` - * Slug `mailing-list-addresses-chaos` - * Attribute Group `mailing-list-addresses` - * Match Role `mailing-list-chaos-member` - * Auth Role `export-mailing-list-addresses` - * Slug `mailing-list-addresses-intern` - * Attribute Group `mailing-list-addresses` - * Match Role `mailing-list-intern-member` - * Auth Role `export-mailing-list-addresses` diff --git a/testing/client-test-export-dooris.sh b/testing/client-test-export-dooris.sh deleted file mode 100755 index b6d4696..0000000 --- a/testing/client-test-export-dooris.sh +++ /dev/null @@ -1,20 +0,0 @@ -#!/bin/sh - -# -# Use curl to run a test export of Dooris ssh keys -# - -set -e - -ACCESS_TOKEN="$(curl -s --request POST \ - --url http://localhost:8080/realms/testing/protocol/openid-connect/token \ - --header 'content-type: application/x-www-form-urlencoded' \ - --data scope=openid \ - --data client_id=export-dooris-ssh-keys \ - --data client_secret=export-dooris-ssh-keys-secret \ - --data grant_type=client_credentials | jq --raw-output .access_token -)" - -curl -s --request GET \ - --url http://localhost:8080/realms/testing/attribute-endpoints-provider/export/dooris-ssh-keys \ - --header "authorization: Bearer ${ACCESS_TOKEN}" \ - --header "content-type: application/json" | jq . - \ No newline at end of file diff --git a/testing/compose.yaml b/testing/compose.yaml index 0311532..ee2a937 100644 --- a/testing/compose.yaml +++ b/testing/compose.yaml @@ -1,6 +1,6 @@ services: keycloak: - image: quay.io/keycloak/keycloak:26.6.0 + image: quay.io/keycloak/keycloak:26.7.0 pull_policy: always command: "start-dev --features=declarative-ui --import-realm" environment: diff --git a/testing/import/testing.json b/testing/import/testing.json index 3744ff8..a91df6c 100644 --- a/testing/import/testing.json +++ b/testing/import/testing.json @@ -470,7 +470,7 @@ "credentials" : [ ], "disableableCredentialTypes" : [ ], "requiredActions" : [ ], - "realmRoles" : [ "export-dooris-ssh-keys", "default-roles-testing" ], + "realmRoles" : [ "default-roles-testing" ], "notBefore" : 0, "groups" : [ ] }, { @@ -484,7 +484,7 @@ "credentials" : [ ], "disableableCredentialTypes" : [ ], "requiredActions" : [ ], - "realmRoles" : [ "export-mailing-list-addresses", "default-roles-testing" ], + "realmRoles" : [ "default-roles-testing" ], "notBefore" : 0, "groups" : [ ] }, { @@ -1478,7 +1478,7 @@ "subType" : "authenticated", "subComponents" : { }, "config" : { - "allowed-protocol-mapper-types" : [ "oidc-sha256-pairwise-sub-mapper", "saml-user-attribute-mapper", "saml-user-property-mapper", "oidc-full-name-mapper", "saml-role-list-mapper", "oidc-address-mapper", "oidc-usermodel-attribute-mapper", "oidc-usermodel-property-mapper" ] + "allowed-protocol-mapper-types" : [ "saml-user-property-mapper", "saml-user-attribute-mapper", "oidc-usermodel-attribute-mapper", "oidc-address-mapper", "oidc-full-name-mapper", "saml-role-list-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-usermodel-property-mapper" ] } }, { "id" : "a49de9bf-462b-4c61-bb52-0373732f4b1b", @@ -1538,7 +1538,7 @@ "subType" : "anonymous", "subComponents" : { }, "config" : { - "allowed-protocol-mapper-types" : [ "saml-role-list-mapper", "oidc-address-mapper", "oidc-sha256-pairwise-sub-mapper", "oidc-usermodel-attribute-mapper", "oidc-full-name-mapper", "oidc-usermodel-property-mapper", "saml-user-property-mapper", "saml-user-attribute-mapper" ] + "allowed-protocol-mapper-types" : [ "oidc-sha256-pairwise-sub-mapper", "oidc-full-name-mapper", "oidc-address-mapper", "saml-role-list-mapper", "oidc-usermodel-attribute-mapper", "saml-user-property-mapper", "oidc-usermodel-property-mapper", "saml-user-attribute-mapper" ] } }, { "id" : "dd4024e9-f080-4319-aeb7-7f9906c345c5", @@ -1625,8 +1625,8 @@ "subComponents" : { }, "config" : { "match-role" : [ "mailing-list-chaos-member" ], - "auth-role" : [ "export-mailing-list-addresses" ], "attribute-group" : [ "mailing-list-addresses" ], + "auth-role" : [ "export-mailing-list-addresses" ], "slug" : [ "mailing-list-addresses-chaos" ] } } ]