Skip to content

Commit 46808c3

Browse files
MarcialRosalesmichaelklishin
MarcialRosales
authored and
michaelklishin
committed
Test with oauth2-proxy
1 parent ab8799a commit 46808c3

12 files changed

+153
-7
lines changed

‎selenium/bin/components/oauth2-proxy

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
#!/usr/bin/env bash
2+
3+
OAUTH2_PROXY_DOCKER_IMAGE=bitnami/oauth2-proxy:7.7.1
4+
5+
ensure_oauth2-proxy() {
6+
if docker ps | grep oauth2-proxy &> /dev/null; then
7+
print "oauth2-proxy already running ..."
8+
else
9+
start_oauth2-proxy
10+
fi
11+
}
12+
init_oauth2-proxy() {
13+
KEYCLOAK_CONFIG_PATH=${KEYCLOAK_CONFIG_PATH:-oauth/keycloak}
14+
KEYCLOAK_CONFIG_DIR=$(realpath ${TEST_DIR}/${KEYCLOAK_CONFIG_PATH})
15+
16+
OAUTH2_PROXY_CONFIG_PATH=${OAUTH2_PROXY_CONFIG_PATH:-oauth/oauth2-proxy}
17+
OAUTH2_PROXY_CONFIG_DIR=$(realpath ${TEST_DIR}/${OAUTH2_PROXY_CONFIG_PATH})
18+
OAUTH2_PROXY_URL=${OAUTH_PROVIDER_URL}
19+
20+
print "> KEYCLOAK_CONFIG_DIR: ${KEYCLOAK_CONFIG_DIR}"
21+
print "> KEYCLOAK_URL: ${KEYCLOAK_URL}"
22+
print "> KEYCLOAK_DOCKER_IMAGE: ${KEYCLOAK_DOCKER_IMAGE}"
23+
24+
print "> OAUTH2_PROXY_CONFIG_DIR: ${OAUTH2_PROXY_CONFIG_DIR}"
25+
print "> OAUTH2_PROXY_URL: ${OAUTH2_PROXY_URL}"
26+
print "> OAUTH2_PROXY_DOCKER_IMAGE: ${OAUTH2_PROXY_DOCKER_IMAGE}"
27+
28+
generate-ca-server-client-kpi oauth2-proxy $OAUTH2_PROXY_CONFIG_DIR
29+
30+
}
31+
start_oauth2-proxy() {
32+
begin "Starting oauth2-proxy ..."
33+
34+
init_oauth2-proxy
35+
kill_container_if_exist oauth2-proxy
36+
37+
MOUNT_OAUTH2_PROXY_CONF_DIR=$CONF_DIR/oauth2-proxy
38+
MOUNT_KEYCLOAK_CONF_DIR=$CONF_DIR/keycloak
39+
40+
mkdir -p $MOUNT_OAUTH2_PROXY_CONF_DIR
41+
mkdir -p $MOUNT_KEYCLOAK_CONF_DIR
42+
${BIN_DIR}/gen-oauth2-proxy-yaml ${OAUTH2_PROXY_CONFIG_DIR} $ENV_FILE $MOUNT_OAUTH2_PROXY_CONF_DIR/alpha-config.yaml
43+
print "> EFFECTIVE OAUTH2_PROXY_CONFIG_FILE: $MOUNT_OAUTH2_PROXY_CONF_DIR/alpha-config.yaml"
44+
cp ${OAUTH2_PROXY_CONFIG_DIR}/*.pem $MOUNT_OAUTH2_PROXY_CONF_DIR
45+
cp ${KEYCLOAK_CONFIG_DIR}/*.pem $MOUNT_KEYCLOAK_CONF_DIR
46+
47+
docker run \
48+
--detach \
49+
--name oauth2-proxy \
50+
--net ${DOCKER_NETWORK} \
51+
--publish 8442:8442 \
52+
--env OAUTH2_PROXY_COOKIE_SECRET=${OAUTH2_PROXY_COOKIE_SECRET} \
53+
--env OAUTH2_PROXY_EMAIL_DOMAINS="*" \
54+
--env OAUTH2_PROXY_COOKIE_DOMAINS="" \
55+
--env OAUTH2_PROXY_WHITELIST_DOMAINS="*" \
56+
--env OAUTH2_PROXY_COOKIE_CSRF_PER_REQUEST="true" \
57+
--env OAUTH2_PROXY_COOKIE_CSRF_EXPIRE="5m" \
58+
--env OAUTH2_PROXY_REDIRECT_URL="https://oauth2-proxy:8442/oauth2/callback" \
59+
--env OAUTH2_PROXY_TLS_KEY_FILE=/etc/oauth2-proxy/certs/server_oauth2-proxy_key.pem \
60+
--env OAUTH2_PROXY_TLS_CERT_FILE=/etc/oauth2-proxy/certs/server_oauth2-proxy_certificate.pem \
61+
-v ${MOUNT_KEYCLOAK_CONF_DIR}:/etc/keycloak \
62+
-v ${MOUNT_OAUTH2_PROXY_CONF_DIR}:/etc/oauth2-proxy \
63+
${OAUTH2_PROXY_DOCKER_IMAGE} --alpha-config /etc/oauth2-proxy/alpha-config.yaml --cookie-secure=true
64+
65+
wait_for_oidc_endpoint oauth2-proxy $OAUTH2_PROXY_URL $MOUNT_OAUTH2_PROXY_CONF_DIR/ca_oauth2-proxy_certificate.pem
66+
end "oauth2-proxy is ready"
67+
68+
}

‎selenium/bin/gen-oauth2-proxy-yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#!/usr/bin/env bash
2+
SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
3+
4+
#set -x
5+
6+
TEST_PATH=${1:?First parameter is the directory env and config files are relative to}
7+
ENV_FILE=${2:?Second parameter is a comma-separated list of .env file which has exported template variables}
8+
FINAL_CONFIG_FILE=${3:?Forth parameter is the name of the final config file. It is relative to where this script is run from}
9+
10+
source $ENV_FILE
11+
12+
parentdir="$(dirname "$FINAL_CONFIG_FILE")"
13+
mkdir -p $parentdir
14+
15+
echo "" > $FINAL_CONFIG_FILE
16+
17+
for f in $($SCRIPT/find-template-files $TEST_PATH "alpha-config" "yaml")
18+
do
19+
envsubst < $f >> $FINAL_CONFIG_FILE
20+
done

‎selenium/full-suite-management-ui

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ authnz-mgt/oauth-idp-initiated-with-uaa-and-prefix-via-proxy.sh
1010
authnz-mgt/oauth-idp-initiated-with-uaa-and-prefix.sh
1111
authnz-mgt/oauth-idp-initiated-with-uaa-via-proxy.sh
1212
authnz-mgt/oauth-idp-initiated-with-uaa.sh
13+
authnz-mgt/oauth-idp-initiated-with-oauth2-proxy-and-keycloak.sh
1314
authnz-mgt/oauth-with-keycloak.sh
1415
authnz-mgt/oauth-with-keycloak-with-verify-none.sh
1516
authnz-mgt/oauth-with-uaa-down-but-with-basic-auth.sh

‎selenium/suites/authnz-mgt/oauth-idp-initiated-with-oauth2-proxy-and-keycloak.sh

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/usr/bin/env bash
2+
3+
SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
4+
5+
TEST_CASES_PATH=/oauth/with-idp-initiated
6+
TEST_CONFIG_PATH=/oauth
7+
PROFILES="oauth2-proxy keycloak keycloak-oauth-provider oauth2-proxy-mgt-oauth-provider tls"
8+
9+
source $SCRIPT/../../bin/suite_template $@
10+
runWith keycloak oauth2-proxy

‎selenium/test/oauth/env.docker.keycloak

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
export KEYCLOAK_URL=https://keycloak:8443/realms/test
2-
export OAUTH_PROVIDER_URL=https://keycloak:8443/realms/test
3-
export OAUTH_PROVIDER_CA_CERT=/config/oauth/keycloak/ca_keycloak_certificate.pem
2+
export OAUTH_PROVIDER_URL=${KEYCLOAK_URL}
3+
export KEYCLOAK_CA_CERT=/config/oauth/keycloak/ca_keycloak_certificate.pem
4+
export OAUTH_PROVIDER_CA_CERT=${KEYCLOAK_CA_CERT}

‎selenium/test/oauth/env.docker.oauth2-proxy

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
export OAUTH2_PROXY_URL=https://oauth2-proxy:8442
2+
export OAUTH2_PROXY_END_SESSION_URL=https://oauth2-proxy:8442/oauth2/sign_out?rd=https://keycloak:8443/realms/test/protocol/openid-connect/logout

‎selenium/test/oauth/env.local.keycloak

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
export KEYCLOAK_URL=https://localhost:8443/realms/test
2-
export OAUTH_PROVIDER_URL=https://localhost:8443/realms/test
3-
export OAUTH_PROVIDER_CA_CERT=selenium/test/oauth/keycloak/ca_keycloak_certificate.pem
2+
export OAUTH_PROVIDER_URL=${KEYCLOAK_URL}
3+
export KEYCLOAK_CA_CERT=selenium/test/oauth/keycloak/ca_keycloak_certificate.pem
4+
export OAUTH_PROVIDER_CA_CERT=${KEYCLOAK_CA_CERT}

‎selenium/test/oauth/env.local.oauth2-proxy

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
export OAUTH2_PROXY_URL=https://oauth2-proxy:8442
2+
export OAUTH2_PROXY_END_SESSION_URL=https://localhost:8442/oauth2/sign_out?rd=https://keycloak:8443/realms/test/protocol/openid-connect/logout

‎selenium/test/oauth/oauth2-proxy/alpha-config.yaml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
2+
server:
3+
BindAddress: 0.0.0.0:4180
4+
SecureBindAddress: 0.0.0.0:8442
5+
TLS:
6+
Key:
7+
FromFile: /etc/oauth2-proxy/server_oauth2-proxy_key.pem
8+
Cert:
9+
FromFile: /etc/oauth2-proxy/server_oauth2-proxy_certificate.pem
10+
11+
upstreamConfig:
12+
upstreams:
13+
- id: rabbitmq
14+
path: /
15+
uri: ${RABBITMQ_URL}
16+
injectRequestHeaders:
17+
- name: Authorization
18+
values:
19+
- claim: access_token
20+
prefix: 'Bearer '
21+
providers:
22+
- provider: keycloak-oidc
23+
id: keycloak-oidc
24+
clientSecret: nt6pmZMeyrgzYgkg2MLgZQZxLveRMW5M
25+
clientID: rabbitmq-proxy-client-tls
26+
code_challenge_method: S256
27+
scope: "email openid profile rabbitmq.tag:administrator"
28+
skipClaimsFromProfileURL: true
29+
caFiles:
30+
- /etc/keycloak/ca_keycloak_certificate.pem
31+
oidcConfig:
32+
issuerURL: ${KEYCLOAK_URL}
33+
insecureSkipNonce: true
34+
audienceClaims:
35+
- aud
36+
emailClaim: sub
37+
userIDClaim: user_name

‎selenium/test/oauth/rabbitmq.keycloak-oauth-provider.conf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
auth_oauth2.issuer = ${OAUTH_PROVIDER_URL}
2-
auth_oauth2.https.cacertfile = ${OAUTH_PROVIDER_CA_CERT}
1+
auth_oauth2.issuer = ${KEYCLOAK_URL}
2+
auth_oauth2.https.cacertfile = ${KEYCLOAK_CA_CERT}

‎selenium/test/oauth/rabbitmq.keycloak-verify-none-oauth-provider.conf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
auth_oauth2.issuer = ${OAUTH_PROVIDER_URL}
1+
auth_oauth2.issuer = ${KEYCLOAK_URL}
22
auth_oauth2.https.peer_verification = verify_none

‎selenium/test/oauth/rabbitmq.oauth2-proxy-mgt-oauth-provider.conf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
2+
auth_oauth2.end_session_endpoint = ${OAUTH2_PROXY_END_SESSION_URL}
3+
management.oauth_provider_url = ${OAUTH2_PROXY_URL}
4+
auth_oauth2.preferred_username_claims.1 = preferred_username

0 commit comments

Comments
 (0)