Skip to content

Commit 98f0dff

Browse files
p53p53
authored
Update keycloak to 26.2.3, use TLS in e2e tests (#569)
1 parent 2cca2d0 commit 98f0dff

File tree

7 files changed

+313
-44
lines changed

7 files changed

+313
-44
lines changed

‎.github/workflows/build.yml

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,12 +29,13 @@ jobs:
2929
with:
3030
cluster-name: "testcluster"
3131
args: >-
32-
-p "8081:80@loadbalancer"
32+
-p "8443:443@loadbalancer"
3333
- name: "Run Tests"
3434
run: |
3535
k3d kubeconfig merge testcluster --kubeconfig-switch-context
36-
KUBECONFIG=~/.k3d/kubeconfig-testcluster.yaml kubectl apply -f ./e2e/k8s/manifest.yml
37-
go test -v -race -coverprofile=profile.cov ./...
36+
export KUBECONFIG=~/.k3d/kubeconfig-testcluster.yaml
37+
kubectl apply -f ./e2e/k8s/manifest.yml
38+
go test -v -timeout=30m -race -coverprofile=profile.cov ./...
3839
# Run Go benchmarks
3940
- name: Benchmark
4041
run: |

‎e2e/e2e_init_test.go

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,47 @@ package e2e_test
22

33
import (
44
"context"
5+
"crypto/x509"
6+
"math/rand"
7+
"os"
8+
"strconv"
59

10+
testsuite_test "github.com/gogatekeeper/gatekeeper/pkg/testsuite"
611
ginkgo "github.com/onsi/ginkgo/v2"
12+
. "github.com/onsi/gomega" //nolint:revive //we want to use it for gomega
713
)
814

15+
//nolint:gosec, gochecknoglobals
16+
var tlsCertificate = os.TempDir() + testsuite_test.FakeCertFilePrefix + strconv.Itoa(rand.Intn(10000))
17+
18+
//nolint:gosec, gochecknoglobals
19+
var tlsPrivateKey = os.TempDir() + testsuite_test.FakePrivFilePrefix + strconv.Itoa(rand.Intn(10000))
20+
21+
//nolint:gosec, gochecknoglobals
22+
var tlsCaCertificate = os.TempDir() + testsuite_test.FakeCaFilePrefix + strconv.Itoa(rand.Intn(10000))
23+
24+
//nolint:gochecknoglobals
25+
var caPool *x509.CertPool
26+
927
var _ = ginkgo.BeforeSuite(func(_ context.Context) {
28+
caPool = x509.NewCertPool()
29+
caPool.AppendCertsFromPEM([]byte(fakeCA))
30+
31+
fakeCertByte := []byte(fakeCert)
32+
err := os.WriteFile(tlsCertificate, fakeCertByte, 0o600)
33+
Expect(err).NotTo(HaveOccurred())
34+
35+
fakeKeyByte := []byte(fakePrivateKey)
36+
err = os.WriteFile(tlsPrivateKey, fakeKeyByte, 0o600)
37+
Expect(err).NotTo(HaveOccurred())
38+
39+
fakeCAByte := []byte(fakeCA)
40+
err = os.WriteFile(tlsCaCertificate, fakeCAByte, 0o600)
41+
Expect(err).NotTo(HaveOccurred())
1042
})
1143

1244
var _ = ginkgo.AfterSuite(func() {
45+
defer os.Remove(tlsCertificate)
46+
defer os.Remove(tlsPrivateKey)
47+
defer os.Remove(tlsCaCertificate)
1348
})

‎e2e/e2e_test.go

Lines changed: 102 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import (
44
"bytes"
55
"context"
66
"crypto/rand"
7+
"crypto/tls"
78
"math/big"
89
"net"
910
"net/http"
@@ -25,6 +26,7 @@ import (
2526
. "github.com/onsi/ginkgo/v2" //nolint:revive //we want to use it for ginkgo
2627
. "github.com/onsi/gomega" //nolint:revive //we want to use it for gomega
2728
"github.com/pquerna/otp/totp"
29+
"golang.org/x/oauth2"
2830
"golang.org/x/oauth2/clientcredentials"
2931
)
3032

@@ -43,8 +45,9 @@ const (
4345
//nolint:gosec
4446
loaTestClientSecret = "4z9PoOooXNFmSCPZx0xHXaUxX4eYGFO0"
4547
timeout = time.Second * 300
46-
idpURI = "http://localhost:8081"
47-
localURI = "http://localhost:"
48+
idpURI = "https://localhost:8443"
49+
localURI = "https://localhost:"
50+
httpLocalURI = "http://localhost:"
4851
logoutURI = "/oauth" + constant.LogoutURL
4952
registerURI = "/oauth" + constant.RegistrationURL
5053
allInterfaces = "0.0.0.0:"
@@ -71,6 +74,50 @@ const (
7174
pkceCookieName = "TESTPKCECOOKIE"
7275
umaCookieName = "TESTUMACOOKIE"
7376
idpRealmURI = idpURI + "/realms/" + testRealm
77+
//nolint:gosec
78+
fakePrivateKey = `
79+
-----BEGIN EC PRIVATE KEY-----
80+
MHcCAQEEIA0wan+Hp0gsbyyZnN/Q8PzaQirGJYBA9g0UT9WIbnl/oAoGCCqGSM49
81+
AwEHoUQDQgAEzYuh8kValY9VN7IGdf1o3u7nt57SFCkpgTx7Dt6s/5FxLBih7Z8v
82+
/6xWYMy1DZ/ftmKhzLdWGBw3/KFTZFW/uQ==
83+
-----END EC PRIVATE KEY-----
84+
`
85+
86+
fakeCert = `
87+
-----BEGIN CERTIFICATE-----
88+
MIIChzCCAi6gAwIBAgIUdNo4UjE80CwFpuB9OabwJfdQx20wCgYIKoZIzj0EAwIw
89+
eDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDVNh
90+
biBGcmFuY2lzY28xHzAdBgNVBAoTFkludGVybmV0IFdpZGdldHMsIEluYy4xDDAK
91+
BgNVBAsTA1dXVzENMAsGA1UEAxMEdGVzdDAeFw0yNTA1MDcyMTUwMDBaFw0zNTA1
92+
MDUyMTUwMDBaMFUxCzAJBgNVBAYTAlVTMQ4wDAYDVQQIEwVUZXhhczEPMA0GA1UE
93+
BxMGRGFsbGFzMRcwFQYDVQQKEw5NeSBDZXJ0aWZpY2F0ZTEMMAoGA1UECxMDV1dX
94+
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEzYuh8kValY9VN7IGdf1o3u7nt57S
95+
FCkpgTx7Dt6s/5FxLBih7Z8v/6xWYMy1DZ/ftmKhzLdWGBw3/KFTZFW/uaOBuDCB
96+
tTAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/
97+
BAIwADAdBgNVHQ4EFgQUzzldhD3SVHdF5+pfWKNV7d725sYwHwYDVR0jBBgwFoAU
98+
bpJPTaf4qmNj18IVY2FOVtI78ZkwQAYDVR0RBDkwN4IJbG9jYWxob3N0hwR/AAAB
99+
hhFodHRwczovL2xvY2FsaG9zdIYRaHR0cHM6Ly8xMjcuMC4wLjEwCgYIKoZIzj0E
100+
AwIDRwAwRAIgE+uhmpQTVryDefftx7mwqJWEDB+UcVchBCj5HEKDq9ACIA/DVtH5
101+
sehNk++XHkJ51nMKkNNyMMcTnuut3DHL8JrB
102+
-----END CERTIFICATE-----
103+
`
104+
105+
fakeCA = `
106+
-----BEGIN CERTIFICATE-----
107+
MIICNTCCAdqgAwIBAgIUVJeIpDwfTA7KEvk0D67mbLKebN0wCgYIKoZIzj0EAwIw
108+
eDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDVNh
109+
biBGcmFuY2lzY28xHzAdBgNVBAoTFkludGVybmV0IFdpZGdldHMsIEluYy4xDDAK
110+
BgNVBAsTA1dXVzENMAsGA1UEAxMEdGVzdDAeFw0yNTA1MDcyMTUwMDBaFw0zNTA1
111+
MDUyMTUwMDBaMHgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYw
112+
FAYDVQQHEw1TYW4gRnJhbmNpc2NvMR8wHQYDVQQKExZJbnRlcm5ldCBXaWRnZXRz
113+
LCBJbmMuMQwwCgYDVQQLEwNXV1cxDTALBgNVBAMTBHRlc3QwWTATBgcqhkjOPQIB
114+
BggqhkjOPQMBBwNCAAShk6FOk8ELcojDxVTk/nS2ptKHxtfUPOBVVnxDPgTsSbgU
115+
i76r16K/GMbQxZ9uLxThdyBE/+zhkEsWZsS7u8roo0IwQDAOBgNVHQ8BAf8EBAMC
116+
AQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUbpJPTaf4qmNj18IVY2FOVtI7
117+
8ZkwCgYIKoZIzj0EAwIDSQAwRgIhAPvq07H/TSu1O6+v4rQR2fBnAoDsGive2scI
118+
OXGLqAOiAiEA6lFfgFB7AhvaYy1VL5vN10FGBvqg2VWBWdAyIcFlP7k=
119+
-----END CERTIFICATE-----
120+
`
74121
)
75122

76123
func generateRandomPort() (string, error) {
@@ -187,7 +234,8 @@ var _ = Describe("NoRedirects Simple login/logout", func() {
187234
osArgs := []string{os.Args[0]}
188235
proxyArgs := []string{
189236
"--discovery-url=" + idpRealmURI,
190-
"--openid-provider-timeout=120s",
237+
"--openid-provider-timeout=300s",
238+
"--skip-openid-provider-tls-verify=true",
191239
"--listen=" + allInterfaces + portNum,
192240
"--client-id=" + testClient,
193241
"--client-secret=" + testClientSecret,
@@ -199,6 +247,9 @@ var _ = Describe("NoRedirects Simple login/logout", func() {
199247
"--openid-provider-retry-count=30",
200248
"--enable-encrypted-token=false",
201249
"--enable-pkce=false",
250+
"--tls-cert=" + tlsCertificate,
251+
"--tls-private-key=" + tlsPrivateKey,
252+
"--tls-ca-certificate=" + tlsCaCertificate,
202253
}
203254

204255
osArgs = append(osArgs, proxyArgs...)
@@ -217,16 +268,27 @@ var _ = Describe("NoRedirects Simple login/logout", func() {
217268
TokenURL: idpRealmURI + constant.IdpTokenURI,
218269
}
219270

220-
respToken, err := conf.Token(ctx)
271+
rClient := resty.New()
272+
hClient := rClient.SetTLSClientConfig(
273+
&tls.Config{RootCAs: caPool, MinVersion: tls.VersionTLS13}).GetClient()
274+
oidcLibCtx := context.WithValue(ctx, oauth2.HTTPClient, hClient)
275+
276+
respToken, err := conf.Token(oidcLibCtx)
221277
Expect(err).NotTo(HaveOccurred())
222278

223-
request := resty.New().SetRedirectPolicy(
279+
rClient = resty.New()
280+
rClient.SetTLSClientConfig(&tls.Config{RootCAs: caPool, MinVersion: tls.VersionTLS13})
281+
282+
request := rClient.SetRedirectPolicy(
224283
resty.NoRedirectPolicy()).R().SetAuthToken(respToken.AccessToken)
225284
resp, err := request.Get(proxyAddress)
226285
Expect(err).NotTo(HaveOccurred())
227286
Expect(resp.StatusCode()).To(Equal(http.StatusOK))
228287

229-
request = resty.New().R().SetAuthToken(respToken.AccessToken)
288+
rClient = resty.New()
289+
rClient.SetTLSClientConfig(&tls.Config{RootCAs: caPool, MinVersion: tls.VersionTLS13})
290+
291+
request = rClient.R().SetAuthToken(respToken.AccessToken)
230292
resp, err = request.Get(proxyAddress + logoutURI)
231293
Expect(err).NotTo(HaveOccurred())
232294
Expect(resp.StatusCode()).To(Equal(http.StatusOK))
@@ -249,7 +311,8 @@ var _ = Describe("Code Flow login/logout", func() {
249311
osArgs := []string{os.Args[0]}
250312
proxyArgs := []string{
251313
"--discovery-url=" + idpRealmURI,
252-
"--openid-provider-timeout=120s",
314+
"--openid-provider-timeout=300s",
315+
"--skip-openid-provider-tls-verify=true",
253316
"--listen=" + allInterfaces + portNum,
254317
"--client-id=" + testClient,
255318
"--client-secret=" + testClientSecret,
@@ -268,6 +331,9 @@ var _ = Describe("Code Flow login/logout", func() {
268331
"--enable-register-handler=true",
269332
"--enable-encrypted-token=false",
270333
"--enable-pkce=false",
334+
"--tls-cert=" + tlsCertificate,
335+
"--tls-private-key=" + tlsPrivateKey,
336+
"--tls-ca-certificate=" + tlsCaCertificate,
271337
}
272338

273339
osArgs = append(osArgs, proxyArgs...)
@@ -281,6 +347,7 @@ var _ = Describe("Code Flow login/logout", func() {
281347
func(_ context.Context) {
282348
var err error
283349
rClient := resty.New()
350+
rClient.SetTLSClientConfig(&tls.Config{RootCAs: caPool, MinVersion: tls.VersionTLS13})
284351
resp := codeFlowLogin(rClient, proxyAddress, http.StatusOK, testUser, testPass)
285352
Expect(resp.Header().Get("Proxy-Accepted")).To(Equal("true"))
286353
body := resp.Body()
@@ -345,6 +412,7 @@ var _ = Describe("Code Flow login/logout", func() {
345412
func(_ context.Context) {
346413
var err error
347414
rClient := resty.New()
415+
rClient.SetTLSClientConfig(&tls.Config{RootCAs: caPool, MinVersion: tls.VersionTLS13})
348416
resp := codeFlowLogin(rClient, proxyAddress, http.StatusOK, testUser, testPass)
349417
Expect(resp.Header().Get("Proxy-Accepted")).To(Equal("true"))
350418
body := resp.Body()
@@ -388,6 +456,7 @@ var _ = Describe("Code Flow login/logout", func() {
388456
func(_ context.Context) {
389457
var err error
390458
rClient := resty.New()
459+
rClient.SetTLSClientConfig(&tls.Config{RootCAs: caPool, MinVersion: tls.VersionTLS13})
391460
reqAddress := proxyAddress + registerURI
392461
resp := registerLogin(rClient, reqAddress, http.StatusOK, testRegisterUser, testRegisterPass)
393462
Expect(resp.Header().Get("Proxy-Accepted")).To(Equal("true"))
@@ -459,7 +528,8 @@ var _ = Describe("Code Flow PKCE login/logout", func() {
459528
osArgs := []string{os.Args[0]}
460529
proxyArgs := []string{
461530
"--discovery-url=" + idpRealmURI,
462-
"--openid-provider-timeout=120s",
531+
"--openid-provider-timeout=300s",
532+
"--skip-openid-provider-tls-verify=true",
463533
"--listen=" + allInterfaces + portNum,
464534
"--client-id=" + pkceTestClient,
465535
"--client-secret=" + pkceTestClientSecret,
@@ -472,6 +542,9 @@ var _ = Describe("Code Flow PKCE login/logout", func() {
472542
"--enable-pkce=true",
473543
"--cookie-pkce-name=" + pkceCookieName,
474544
"--enable-encrypted-token=false",
545+
"--tls-cert=" + tlsCertificate,
546+
"--tls-private-key=" + tlsPrivateKey,
547+
"--tls-ca-certificate=" + tlsCaCertificate,
475548
}
476549

477550
osArgs = append(osArgs, proxyArgs...)
@@ -485,6 +558,8 @@ var _ = Describe("Code Flow PKCE login/logout", func() {
485558
func(_ context.Context) {
486559
var err error
487560
rClient := resty.New()
561+
rClient.SetTLSClientConfig(&tls.Config{RootCAs: caPool, MinVersion: tls.VersionTLS13})
562+
488563
resp := codeFlowLogin(rClient, proxyAddress, http.StatusOK, testUser, testPass)
489564
Expect(resp.Header().Get("Proxy-Accepted")).To(Equal("true"))
490565

@@ -513,12 +588,13 @@ var _ = Describe("Code Flow login/logout with session check", func() {
513588
server := httptest.NewServer(&testsuite_test.FakeUpstreamService{})
514589
portNum, err = generateRandomPort()
515590
Expect(err).NotTo(HaveOccurred())
516-
proxyAddressFirst = "http://127.0.0.1:" + portNum
591+
proxyAddressFirst = "https://127.0.0.1:" + portNum
517592

518593
osArgs := []string{os.Args[0]}
519594
proxyArgs := []string{
520595
"--discovery-url=" + idpRealmURI,
521-
"--openid-provider-timeout=120s",
596+
"--openid-provider-timeout=300s",
597+
"--skip-openid-provider-tls-verify=true",
522598
"--listen=" + allInterfaces + portNum,
523599
"--client-id=" + testClient,
524600
"--client-secret=" + testClientSecret,
@@ -534,6 +610,9 @@ var _ = Describe("Code Flow login/logout with session check", func() {
534610
"--post-logout-redirect-uri=http://google.com",
535611
"--enable-encrypted-token=false",
536612
"--enable-pkce=false",
613+
"--tls-cert=" + tlsCertificate,
614+
"--tls-private-key=" + tlsPrivateKey,
615+
"--tls-ca-certificate=" + tlsCaCertificate,
537616
}
538617

539618
osArgs = append(osArgs, proxyArgs...)
@@ -545,7 +624,8 @@ var _ = Describe("Code Flow login/logout with session check", func() {
545624
osArgs = []string{os.Args[0]}
546625
proxyArgs = []string{
547626
"--discovery-url=" + idpRealmURI,
548-
"--openid-provider-timeout=120s",
627+
"--openid-provider-timeout=300s",
628+
"--skip-openid-provider-tls-verify=true",
549629
"--listen=" + allInterfaces + portNum,
550630
"--client-id=" + pkceTestClient,
551631
"--client-secret=" + pkceTestClientSecret,
@@ -562,6 +642,9 @@ var _ = Describe("Code Flow login/logout with session check", func() {
562642
"--enable-id-token-cookie=true",
563643
"--post-logout-redirect-uri=http://google.com",
564644
"--enable-encrypted-token=false",
645+
"--tls-cert=" + tlsCertificate,
646+
"--tls-private-key=" + tlsPrivateKey,
647+
"--tls-ca-certificate=" + tlsCaCertificate,
565648
}
566649

567650
osArgs = append(osArgs, proxyArgs...)
@@ -572,6 +655,7 @@ var _ = Describe("Code Flow login/logout with session check", func() {
572655
It("should logout on both successfully", func(_ context.Context) {
573656
var err error
574657
rClient := resty.New()
658+
rClient.SetTLSClientConfig(&tls.Config{RootCAs: caPool, MinVersion: tls.VersionTLS13})
575659
resp := codeFlowLogin(rClient, proxyAddressFirst, http.StatusOK, testUser, testPass)
576660
Expect(resp.Header().Get("Proxy-Accepted")).To(Equal("true"))
577661
resp = codeFlowLogin(rClient, proxyAddressSec, http.StatusOK, testUser, testPass)
@@ -620,7 +704,8 @@ var _ = Describe("Level Of Authentication Code Flow login/logout", func() {
620704
osArgs := []string{os.Args[0]}
621705
proxyArgs := []string{
622706
"--discovery-url=" + idpRealmURI,
623-
"--openid-provider-timeout=120s",
707+
"--openid-provider-timeout=300s",
708+
"--skip-openid-provider-tls-verify=true",
624709
"--listen=" + allInterfaces + portNum,
625710
"--client-id=" + loaTestClient,
626711
"--client-secret=" + loaTestClientSecret,
@@ -641,6 +726,9 @@ var _ = Describe("Level Of Authentication Code Flow login/logout", func() {
641726
"--post-login-redirect-path=" + postLoginRedirectPath,
642727
"--enable-encrypted-token=false",
643728
"--enable-pkce=false",
729+
"--tls-cert=" + tlsCertificate,
730+
"--tls-private-key=" + tlsPrivateKey,
731+
"--tls-ca-certificate=" + tlsCaCertificate,
644732
}
645733

646734
osArgs = append(osArgs, proxyArgs...)
@@ -655,6 +743,7 @@ var _ = Describe("Level Of Authentication Code Flow login/logout", func() {
655743
func(_ context.Context) {
656744
var err error
657745
rClient := resty.New()
746+
rClient.SetTLSClientConfig(&tls.Config{RootCAs: caPool, MinVersion: tls.VersionTLS13})
658747
resp := codeFlowLogin(rClient, proxyAddress, http.StatusOK, testLoAUser, testLoAPass)
659748
Expect(resp.Header().Get("Proxy-Accepted")).To(Equal("true"))
660749
body := resp.Body()
@@ -728,6 +817,7 @@ var _ = Describe("Level Of Authentication Code Flow login/logout", func() {
728817
func(_ context.Context) {
729818
var err error
730819
rClient := resty.New()
820+
rClient.SetTLSClientConfig(&tls.Config{RootCAs: caPool, MinVersion: tls.VersionTLS13})
731821
resp := codeFlowLogin(rClient, proxyAddress, http.StatusOK, testLoAUser, testLoAPass)
732822
Expect(resp.Header().Get("Proxy-Accepted")).To(Equal("true"))
733823
body := resp.Body()

0 commit comments

Comments
 (0)