Skip to content

Commit 8a15a5f

Browse files
xekopenshift-merge-bot[bot]
xek
authored and
openshift-merge-bot[bot]
committed
[federation] Add OIDC authentication flows tests
This adds support for testing all OIDC authentication methods: - v3oidcpassword (Resource Owner Password Credentials) - v3oidcclientcredentials (Client Credentials) - v3oidcaccesstoken (Access Token Reuse) - v3oidcauthcode (Authorization Code) Note: v3oidcdeviceauthz requires Python 3.10+ and is not available in OSP18 which ships with Python 3.9. Assisted-by: Claude Opus Signed-off-by: Grzegorz Grasza <xek@redhat.com>
1 parent 4a40c48 commit 8a15a5f

12 files changed

Lines changed: 806 additions & 58 deletions

‎docs/dictionary/en-custom.txt‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ UTF
3333
ZipFile
3434
aaabbcc
3535
abcdefghij
36+
accesstoken
3637
addr
3738
aes
3839
afuscoar
@@ -53,6 +54,7 @@ args
5354
arx
5455
arxcruz
5556
auth
57+
authcode
5658
authfile
5759
autoconfiguration
5860
autoheld
@@ -121,6 +123,7 @@ cjeanner
121123
ckcg
122124
cli
123125
client
126+
clientcredentials
124127
clusterimageset
125128
clusterpool
126129
cmd
@@ -177,6 +180,7 @@ dev
177180
devscript
178181
devscripts
179182
devsetup
183+
deviceauthz
180184
dfb
181185
dfce
182186
dfg
@@ -315,11 +319,15 @@ junos
315319
jxe
316320
jzxbol
317321
kcgpby
322+
kctestuser1
323+
kctestuser2
318324
keepalived
319325
kerberos
320326
keycloak
321327
keypair
322328
keyring
329+
keystoneauth
330+
keystoneauth1
323331
keytab
324332
kinit
325333
kni
@@ -393,6 +401,7 @@ mtu
393401
multiline
394402
multinode
395403
multipath
404+
multirealm
396405
multus
397406
myorg
398407
mysqld
@@ -445,6 +454,10 @@ ocpbm
445454
ocppr
446455
odkvmf
447456
oidc
457+
oidcaccesstoken
458+
oidcauthcode
459+
oidcclientcredentials
460+
oidcpassword
448461
okd
449462
ol
450463
olm
@@ -652,6 +665,11 @@ usermod
652665
usr
653666
utils
654667
uuid
668+
v3oidcaccesstoken
669+
v3oidcauthcode
670+
v3oidcclientcredentials
671+
v3oidcdeviceauthz
672+
v3oidcpassword
655673
vbibob
656674
vbmc
657675
vcgvuc

‎roles/federation/README.md‎

Lines changed: 148 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,149 @@
1-
federation
2-
=========
1+
# federation
32

4-
This role will setup Openstack for user federation. The keycloak system will be used for the IdP provider.
3+
This role sets up OpenStack Keystone federation with Keycloak (Red Hat SSO) as the Identity Provider.
4+
5+
## Overview
6+
7+
The federation role configures:
8+
- Keycloak realm(s) with test users and groups
9+
- Keystone Identity Provider and protocol configuration
10+
- OIDC authentication for OpenStack CLI
11+
- Comprehensive authentication testing
12+
13+
## Supported OIDC Authentication Methods
14+
15+
This role supports testing all OIDC authentication methods available in keystoneauth1:
16+
17+
| Plugin Name | Description | Status |
18+
|-------------|-------------|--------|
19+
| `v3oidcpassword` | Resource Owner Password Credentials flow | ✅ Supported |
20+
| `v3oidcclientcredentials` | Client Credentials flow | ✅ Supported |
21+
| `v3oidcaccesstoken` | Reuse existing access token | ✅ Supported |
22+
| `v3oidcauthcode` | Authorization Code flow | ✅ Supported |
23+
| `v3oidcdeviceauthz` | Device Authorization flow (RFC 8628) | ⚠️ Requires Python 3.10+ |
24+
25+
## Variables
26+
27+
### Infrastructure Configuration
28+
29+
| Variable | Default | Description |
30+
|----------|---------|-------------|
31+
| `cifmw_federation_keycloak_namespace` | `openstack` | Kubernetes namespace for Keycloak |
32+
| `cifmw_federation_run_osp_cmd_namespace` | `openstack` | Kubernetes namespace for openstackclient |
33+
| `cifmw_federation_domain` | - | Base domain for service URLs |
34+
35+
### Keycloak Configuration
36+
37+
| Variable | Default | Description |
38+
|----------|---------|-------------|
39+
| `cifmw_federation_keycloak_realm` | `openstack` | Primary Keycloak realm name |
40+
| `cifmw_federation_keycloak_realm2` | `openstack2` | Secondary realm (multirealm mode) |
41+
| `cifmw_federation_keycloak_admin_username` | `admin` | Keycloak admin username |
42+
| `cifmw_federation_keycloak_admin_password` | `nomoresecrets` | Keycloak admin password |
43+
| `cifmw_federation_deploy_multirealm` | `false` | Deploy multiple realms |
44+
45+
### Test Users
46+
47+
| Variable | Default | Description |
48+
|----------|---------|-------------|
49+
| `cifmw_federation_keycloak_testuser1_username` | `kctestuser1` | Test user 1 username |
50+
| `cifmw_federation_keycloak_testuser1_password` | `nomoresecrets1` | Test user 1 password |
51+
| `cifmw_federation_keycloak_testuser2_username` | `kctestuser2` | Test user 2 username |
52+
| `cifmw_federation_keycloak_testuser2_password` | `nomoresecrets2` | Test user 2 password |
53+
54+
### Keystone Integration
55+
56+
| Variable | Default | Description |
57+
|----------|---------|-------------|
58+
| `cifmw_federation_IdpName` | `kcIDP` | Identity Provider name in Keystone |
59+
| `cifmw_federation_keystone_domain` | `SSO` | Keystone domain for federated users |
60+
| `cifmw_federation_mapping_name` | `SSOmap` | Keystone mapping name |
61+
| `cifmw_federation_project_name` | `SSOproject` | Project for federated users |
62+
| `cifmw_federation_group_name` | `SSOgroup` | Group for federated users |
63+
64+
### OIDC Client Configuration
65+
66+
| Variable | Default | Description |
67+
|----------|---------|-------------|
68+
| `cifmw_federation_keystone_OIDC_ClientID` | `rhoso` | OIDC client ID |
69+
| `cifmw_federation_keystone_OIDC_ClientSecret` | `COX8bmlKAWn56XCGMrKQJj7dgHNAOl6f` | OIDC client secret |
70+
| `cifmw_federation_keystone_OIDC_Scope` | `openid email profile` | OIDC scopes |
71+
72+
### Testing Configuration
73+
74+
| Variable | Default | Description |
75+
|----------|---------|-------------|
76+
| `cifmw_federation_run_oidc_auth_tests` | `true` | Run OIDC auth tests |
77+
78+
## Task Files
79+
80+
### Main Tasks
81+
82+
- `hook_pre_deploy.yml` - Deploys Keycloak before OpenStack
83+
- `hook_post_deploy.yml` - Configures federation after OpenStack deployment
84+
- `hook_controlplane_config.yml` - Adds federation config to control plane
85+
86+
### Setup Tasks
87+
88+
- `run_keycloak_setup.yml` - Deploy Keycloak operator and instance
89+
- `run_keycloak_realm_setup.yml` - Configure Keycloak realm, users, and client
90+
- `run_keycloak_client_setup.yml` - Enable advanced client features (Service Accounts, Device Auth)
91+
- `run_openstack_setup.yml` - Configure Keystone IdP and mappings
92+
- `run_openstack_auth_setup.yml` - Deploy authentication scripts to openstackclient pod
93+
94+
### Test Tasks
95+
96+
- `run_openstack_oidc_auth_tests.yml` - Comprehensive OIDC authentication test suite
97+
98+
## Authentication Scripts
99+
100+
The following scripts are deployed to `/home/cloud-admin/` in the openstackclient pod:
101+
102+
| Script | Description |
103+
|--------|-------------|
104+
| `get-token.sh <user>` | Get token using v3oidcpassword |
105+
| `oidc-clientcredentials.sh` | Configure v3oidcclientcredentials auth |
106+
| `oidc-accesstoken.sh <token>` | Configure v3oidcaccesstoken auth |
107+
| `oidc-authcode.sh <code>` | Configure v3oidcauthcode auth |
108+
| `get-keycloak-token.sh` | Helper to obtain tokens from Keycloak |
109+
110+
### Example Usage
111+
112+
```bash
113+
# v3oidcpassword - Password flow
114+
kubectl exec -n openstack openstackclient -- bash -c \
115+
'source /home/cloud-admin/kctestuser1 && openstack token issue'
116+
117+
# v3oidcclientcredentials - Client Credentials flow
118+
kubectl exec -n openstack openstackclient -- bash -c \
119+
'source /home/cloud-admin/oidc-clientcredentials.sh && openstack token issue'
120+
121+
# v3oidcaccesstoken - Access Token flow
122+
ACCESS_TOKEN=$(/home/cloud-admin/get-keycloak-token.sh access_token kctestuser1 nomoresecrets1)
123+
kubectl exec -n openstack openstackclient -- bash -c \
124+
"source /home/cloud-admin/oidc-accesstoken.sh '$ACCESS_TOKEN' && openstack token issue"
125+
126+
# v3oidcauthcode - Authorization Code flow
127+
AUTH_CODE=$(/home/cloud-admin/get-keycloak-token.sh auth_code kctestuser1 nomoresecrets1)
128+
kubectl exec -n openstack openstackclient -- bash -c \
129+
"source /home/cloud-admin/oidc-authcode.sh '$AUTH_CODE' && openstack token issue"
130+
```
131+
132+
## Test Execution
133+
134+
The OIDC authentication tests are automatically run during the `hook_post_deploy.yml` phase when `cifmw_federation_run_oidc_auth_tests` is `true` (default).
135+
136+
To run the tests manually:
137+
138+
```yaml
139+
- name: Run OIDC authentication tests
140+
ansible.builtin.include_role:
141+
name: federation
142+
tasks_from: run_openstack_oidc_auth_tests.yml
143+
```
144+
145+
## Notes
146+
147+
- **Device Authorization Flow**: The `v3oidcdeviceauthz` plugin requires keystoneauth1 with Python 3.10+ support. OSP18 ships with Python 3.9 and does not include this plugin.
148+
- **Multirealm**: CLI-based OIDC authentication testing only works in single realm mode. Multirealm federation is supported for Horizon-based authentication.
149+
- **Keycloak Client**: The role automatically enables Service Accounts and Device Authorization on the Keycloak client to support all authentication methods.

‎roles/federation/defaults/main.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -163,3 +163,20 @@ cifmw_federation_keystone_idp1_provider_filename: "keycloak-{{ cifmw_federation_
163163
cifmw_federation_keystone_idp2_conf_filename: "keycloak-{{ cifmw_federation_keycloak_namespace }}.{{ cifmw_federation_domain }}%2Fauth%2Frealms%2F{{ cifmw_federation_keycloak_realm2 }}.conf"
164164
cifmw_federation_keystone_idp2_client_filename: "keycloak-{{ cifmw_federation_keycloak_namespace }}.{{ cifmw_federation_domain }}%2Fauth%2Frealms%2F{{ cifmw_federation_keycloak_realm2 }}.client"
165165
cifmw_federation_keystone_idp2_provider_filename: "keycloak-{{ cifmw_federation_keycloak_namespace }}.{{ cifmw_federation_domain }}%2Fauth%2Frealms%2F{{ cifmw_federation_keycloak_realm2 }}.provider"
166+
167+
# =============================================================================
168+
# OIDC AUTHENTICATION TESTING
169+
# =============================================================================
170+
# Configuration for OIDC authentication method testing
171+
#
172+
# When enabled, tests all supported OIDC authentication methods:
173+
# - v3oidcpassword: Resource Owner Password Credentials flow
174+
# - v3oidcclientcredentials: Client Credentials flow
175+
# - v3oidcaccesstoken: Access Token Reuse flow
176+
# - v3oidcauthcode: Authorization Code flow
177+
#
178+
# Note: v3oidcdeviceauthz (Device Authorization flow) requires Python 3.10+
179+
# and is not available in OSP18.
180+
181+
# Enable/disable OIDC authentication method tests
182+
cifmw_federation_run_oidc_auth_tests: true

‎roles/federation/tasks/hook_post_deploy.yml‎

Lines changed: 21 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -84,13 +84,26 @@
8484

8585
# MultiRole CLI testing is not available. It is only currently supported in Horizon.
8686
# Auth tests only run in single realm mode - not supported in multirealm
87-
- name: Run federation OSP User Auth test for first realm
87+
88+
# =============================================================================
89+
# OIDC Authentication Methods Testing
90+
# =============================================================================
91+
# Tests all supported OIDC authentication methods when enabled.
92+
# This requires Keycloak client to be configured for Service Accounts
93+
# and Device Authorization.
94+
95+
- name: Configure Keycloak client for OIDC auth methods
8896
ansible.builtin.include_role:
8997
name: federation
90-
tasks_from: run_openstack_auth_test.yml
91-
vars:
92-
cifmw_federation_keycloak_testuser_username: "{{ item }}"
93-
loop:
94-
- "{{ cifmw_federation_keycloak_testuser1_username }}"
95-
- "{{ cifmw_federation_keycloak_testuser2_username }}"
96-
when: not cifmw_federation_deploy_multirealm|bool
98+
tasks_from: run_keycloak_client_setup.yml
99+
when:
100+
- not cifmw_federation_deploy_multirealm | bool
101+
- cifmw_federation_run_oidc_auth_tests | default(true) | bool
102+
103+
- name: Run OIDC authentication method tests
104+
ansible.builtin.include_role:
105+
name: federation
106+
tasks_from: run_openstack_oidc_auth_tests.yml
107+
when:
108+
- not cifmw_federation_deploy_multirealm | bool
109+
- cifmw_federation_run_oidc_auth_tests | default(true) | bool

0 commit comments

Comments
 (0)