test: external-IdP e2e coverage (Keycloak OIDC + LDAP) behind auth-idp tag#24499
Merged
Conversation
…a Keycloak Adds an 'auth-idp' tagged e2e suite covering the external-IdP code path (DhisOidcProvider/DhisOidcUser/Dhis2JwtAuthenticationManagerResolver), which had zero automated coverage: - docker-compose.e2e-auth.yml overlay: Keycloak 26 with an imported realm (config/keycloak/realm-dhis2.json) and a dedicated DHIS2_HOME (config/dhis2_home_auth/) so the extra login provider never affects the default e2e suite. - KeycloakOidcLoginTest: browser redirect flow via Selenium, email claim -> User.openId mapping, authorities from DHIS2 roles, unmapped IdP user fails to /login/?oidcFailure=true, loginConfig advertises the provider. - KeycloakJwtBearerTest: direct-access-grant tokens against the API, issuer/audience validation, unmapped and garbage token rejection, and the @RequiresAuthority 403 message contract + superuser bypass over bearer auth. - pom.xml: default profile now excludes 'auth-idp'; new auth-idp profile runs the tagged tests. - run-auth-idp-tests.yml: runs the suite on PRs touching security paths, nightly on master, and on manual dispatch. Verified locally: full stack boot + 8/8 tests green inside the compose network. AI Assisted
Extends the auth-idp e2e stack with an OpenLDAP container and LdapLoginTest,
covering CustomLdapAuthenticationProvider/DhisBindAuthenticator which had
zero automated coverage:
- osixia/openldap service in docker-compose.e2e-auth.yml, seeded from
config/ldap/users.ldif; ldap.* block in config/dhis2_home_auth/dhis.conf.
- Pins: users route to LDAP only with ldapId + externalAuth=true; the
(cn={0}) filter is filled with User.ldapId (fixtures make ldapId differ
from the username to prove the rewrite); authorities come from DHIS2
roles; the DHIS2-stored password never authenticates an LDAP user;
LDAP-only entries without a DHIS2 user are rejected; regular users keep
DB-password login while LDAP is enabled; @RequiresAuthority 403 message
contract and superuser bypass hold over LDAP sessions.
Verified locally: full auth-idp stack boot, 14/14 green (8 Keycloak + 6 LDAP).
AI Assisted
netroms
marked this pull request as draft
July 19, 2026 08:44
For same-repo PRs, pull the dhis2/core-pr:<number> image that the api tests workflow pushes to Docker Hub (verified against the PR head SHA via the DHIS2_BUILD_REVISION label) instead of rebuilding it. Fork and dependabot PRs, nightly and manual runs still build the image locally.
netroms
marked this pull request as ready for review
July 20, 2026 13:25
jbee
approved these changes
Jul 20, 2026
|
david-mackessy
approved these changes
Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
New
auth-idptagged e2e suite covering the external-IdP authentication paths, which had zero automated coverage. Excluded from the default profile; runs on every PR via a new workflow, plus nightly and manual dispatch. Part of the auth coverage initiative; companion to #24497.docker-compose.e2e-auth.ymloverlay (Keycloak 26 with imported realm, OpenLDAP with LDIF seed) + dedicatedconfig/dhis2_home_auth/so extra login providers never affect the default suite.KeycloakOidcLoginTest: browser redirect flow (Selenium), email claim ->User.openIdmapping, authorities from DHIS2 roles, unmapped IdP user fails to/login/?oidcFailure=true.KeycloakJwtBearerTest: direct-access-grant tokens, issuer/audience validation, unmapped/garbage rejection,@RequiresAuthority403 contract + superuser bypass over bearer.LdapLoginTest: bind auth requiresldapId+externalAuth;(cn={0})filter getsUser.ldapId(fixtures differ from username to prove the rewrite); DB password never authenticates LDAP users; regular users unaffected.run-auth-idp-tests.ymlruns on all PRs. For same-repo PRs it skips the Maven build and pulls thedhis2/core-pr:<number>image published by the "Run api tests" workflow (polling until theDHIS2_BUILD_REVISIONlabel matches the PR head SHA, so both suites test the identical image). Fork/dependabot PRs, nightly and dispatch runs build the image locally as before. Test execution itself is ~40s; the job is off the PR critical path since the full e2e job takes longer.Testing
Verified locally: full stack boot, 14/14 green (8 Keycloak + 6 LDAP).
AI Assisted