keycloak-attribute-endpoints-provider/testing/README.md

Integration Testing

This directory contains infrastructure and tests to verify end-to-end operation of the provider.

Creating a Testing Keycloak

The Docker Compose setup in this directory sets up Keycloak and imports a realm testing.

Run docker compose up -d to start Keycloak. The admin console will be available at http://localhost:8080/.

You can attach a Java debugger at localhost:8081.

The realm export is in import/testing.json. It will be imported automatically when Keycloak starts.

Updating the Realm

If you want to make changes to the testing realm and persist them, you need to export the realm.

The following command runs the Keycloak export for the realm testing storing it in the mapped directory import/testing.json. The copying of the database is necessary to avoid locking errors. env -i makes sure the regular environment variables are not set to avoid port conflicts.

docker compose exec -it keycloak sh -c "cp -rp /opt/keycloak/data/h2 /tmp && env -i -- /opt/keycloak/bin/kc.sh export --db dev-file --db-url 'jdbc:h2:file:/tmp/h2/keycloakdb;NON_KEYWORDS=VALUE' --file /opt/keycloak/data/import/testing.json --realm testing"

Running Integration Tests

This directory contains shell scripts that exercise the attribute endpoint.

Bring up Keycloak with docker compose up -d, then run one of the client-test-export-*.sh scripts.

$ ./client-test-export-dooris.sh
All attributes collated into a single list
[
  "hacker-ssh-key-1",
  "hacker-ssh-key-2"
]
Results mapped per attribute
{
  "ssh-key-1": [
    "hacker-ssh-key-1"
  ],
  "ssh-key-2": [
    "hacker-ssh-key-2"
  ]
}
$ ./client-test-export-mailing-lists.sh 
chaos@
[
  "hacker+chaos@example.net",
  "tester+chaos@example.com"
]
intern@
[
  "hacker+intern@example.net"
]

Realm testing Configuration

The realm contains these objects:

• Clients:
  • export-dooris-ssh-keys with secret export-dooris-ssh-keys-secret and user service-account-export-dooris-ssh-keys
  • export-mailing-list-addresses with secret export-mailing-list-addresses-secret and user service-account-export-mailing-list-addresses
• Realm Roles:
  • dooris-authorized to assign to users whose SSH keys should be exported
  • mailing-list-chaos-member to assign to users who are a member of the chaos mailing list
  • mailing-list-intern-member to assign to users who are a member of the intern mailing list
  • export-dooris-ssh-keys to assign to service account users that should be allowed to use the dooris endpoint config
  • export-mailing-list-addresses to assign to service account users that should be allowed to use the mailing list endpoint configs
• Groups:
  • chaos with role mailing-list-chaos-member
  • ìntern with roles dooris-authorized, mailing-list-chaos-member and mailing-list-intern-member
• Users:
  • tester (Tony Tester), email tester@example.com, member of group chaos
    • Mailing List Addresses:
      • Chaos: tester+chaos@example.com
      • Intern: tester+intern@example.com
    • Dooris SSH Keys:
      • SSH Key 1: tester-ssh-key-1
      • SSH Key 2: tester-ssh-key-2
  • hacker (Hans Acker), email hacker@example.net, member of groups chaosand intern
    • Mailing List Addresses:
      • Chaos: hacker+chaos@example.net
      • Intern: hacker+intern@example.net
    • Dooris SSH Keys:
      • SSH Key 1: hacker-ssh-key-1
      • SSH Key 2: hacker-ssh-key-2
  • service-account-export-dooris-ssh-keys
    • Role export-dooris-ssh-keys
  • service-account-export-mailing-list-addresses
    • Role export-mailing-list-addresses
• Realm Settings:
  • User Profile:
    • Attribute Groups:
      • dooris-ssh-keys
      • mailing-list-addresses
    • Attributes:
      • mailing-list-address-chaos
        • Attribute Group mailing-list-addresses
      • mailing-list-address-intern
        • Attribute Group mailing-list-addresses
      • ssh-key-1
        • Attribute Group dooris-ssh-keys
      • ssh-key-2
        • Attribute Group dooris-ssh-keys
• Custom Attributes:
  • Slug dooris-ssh-keys
    • Attribute Group dooris-ssh-keys
    • Match Role dooris-authorized
    • Auth Role export-dooris-ssh-keys
  • Slug mailing-list-addresses-chaos
    • Attribute Group mailing-list-addresses
    • Match Role mailing-list-chaos-member
    • Auth Role export-mailing-list-addresses
  • Slug mailing-list-addresses-intern
    • Attribute Group mailing-list-addresses
    • Match Role mailing-list-intern-member
    • Auth Role export-mailing-list-addresses