diff --git a/operator/src/test/java/org/keycloak/operator/testsuite/integration/ClusteringTest.java b/operator/src/test/java/org/keycloak/operator/testsuite/integration/ClusteringTest.java index d764bf4324..65204a604a 100644 --- a/operator/src/test/java/org/keycloak/operator/testsuite/integration/ClusteringTest.java +++ b/operator/src/test/java/org/keycloak/operator/testsuite/integration/ClusteringTest.java @@ -172,7 +172,7 @@ public class ClusteringTest extends BaseOperatorTest { .untilAsserted(() -> assertThat(crSelector.scale().getStatus().getReplicas()).isEqualTo(2)); // get the service - String url = "https://" + KeycloakServiceDependentResource.getServiceName(kc) + "." + namespace + ":" + Constants.KEYCLOAK_HTTPS_PORT; + String url = "https://" + KeycloakServiceDependentResource.getServiceName(kc) + "." + namespace + ":" + Constants.KEYCLOAK_HTTPS_PORT + "/admin/master/console/"; Awaitility.await().atMost(5, MINUTES).untilAsserted(() -> { Log.info("Starting curl Pod to test if the realm is available"); diff --git a/operator/src/test/java/org/keycloak/operator/testsuite/integration/KeycloakDeploymentTest.java b/operator/src/test/java/org/keycloak/operator/testsuite/integration/KeycloakDeploymentTest.java index 3c11de21af..20f45c1110 100644 --- a/operator/src/test/java/org/keycloak/operator/testsuite/integration/KeycloakDeploymentTest.java +++ b/operator/src/test/java/org/keycloak/operator/testsuite/integration/KeycloakDeploymentTest.java @@ -661,7 +661,7 @@ public class KeycloakDeploymentTest extends BaseOperatorTest { assertThat(k8sclient.resources(Service.class).withName(serviceName).require().getSpec().getPorts() .stream().map(ServicePort::getName).anyMatch(protocol::equals)); - String url = protocol + "://" + serviceName + "." + namespace + ":" + port; + String url = protocol + "://" + serviceName + "." + namespace + ":" + port + "/admin/master/console/"; Log.info("Checking url: " + url); var curlOutput = K8sUtils.inClusterCurl(k8sclient, namespace, url); diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/HostnameDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/HostnameDistTest.java index ffde46cbf7..9a82d1ae69 100644 --- a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/HostnameDistTest.java +++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/HostnameDistTest.java @@ -19,13 +19,17 @@ package org.keycloak.it.cli.dist; import io.quarkus.test.junit.main.Launch; import io.restassured.RestAssured; +import io.restassured.config.RedirectConfig; +import io.restassured.config.RestAssuredConfig; import org.apache.commons.lang3.StringUtils; +import org.apache.http.HttpHeaders; import org.hamcrest.Matchers; import org.junit.Assert; import org.junit.jupiter.api.BeforeAll; import org.junit.jupiter.api.Test; import org.keycloak.it.junit5.extension.DistributionTest; import org.keycloak.it.junit5.extension.RawDistOnly; +import org.keycloak.it.junit5.extension.WithEnvVars; import org.keycloak.protocol.oidc.representations.OIDCConfigurationRepresentation; import org.keycloak.quarkus.runtime.services.resources.DebugHostnameSettingsResource; @@ -35,12 +39,15 @@ import static io.restassured.RestAssured.when; import static org.hamcrest.MatcherAssert.assertThat; @DistributionTest(keepAlive = true, enableTls = true, defaultOptions = { "--http-enabled=true" }) +@WithEnvVars({"KEYCLOAK_ADMIN", "admin123", "KEYCLOAK_ADMIN_PASSWORD", "admin123"}) @RawDistOnly(reason = "Containers are immutable") public class HostnameDistTest { @BeforeAll public static void onBeforeAll() { RestAssured.useRelaxedHTTPSValidation(); + RestAssuredConfig config = RestAssured.config; + RestAssured.config = config.redirect(RedirectConfig.redirectConfig().followRedirects(false)); } @Test @@ -121,10 +128,10 @@ public class HostnameDistTest { @Test @Launch({ "start", "--hostname=mykeycloak.org", "--hostname-port=8543" }) public void testWelcomePageAdminUrl() { - when().get("http://mykeycloak.org:8080").then().body(Matchers.containsString("http://mykeycloak.org:8080/admin/")); - when().get("https://mykeycloak.org:8443").then().body(Matchers.containsString("https://mykeycloak.org:8443/admin/")); - when().get("http://localhost:8080").then().body(Matchers.containsString("http://localhost:8080/admin/")); - when().get("https://localhost:8443").then().body(Matchers.containsString("https://localhost:8443/admin/")); + when().get("http://mykeycloak.org:8080").then().header(HttpHeaders.LOCATION, Matchers.containsString("http://mykeycloak.org:8080/admin/")); + when().get("https://mykeycloak.org:8443").then().header(HttpHeaders.LOCATION, Matchers.containsString("https://mykeycloak.org:8443/admin/")); + when().get("http://localhost:8080").then().header(HttpHeaders.LOCATION, Matchers.containsString("http://localhost:8080/admin/")); + when().get("https://localhost:8443").then().header(HttpHeaders.LOCATION, Matchers.containsString("https://localhost:8443/admin/")); } @Test @@ -162,20 +169,20 @@ public class HostnameDistTest { @Test @Launch({ "start", "--hostname=mykeycloak.org", "--hostname-admin=mykeycloakadmin.org" }) public void testHostnameAdminSet() { - when().get("https://mykeycloak.org:8443/admin/master/console").then().body(Matchers.containsString("\"authUrl\": \"https://mykeycloakadmin.org:8443\"")); + when().get("https://mykeycloak.org:8443/admin/master/console/").then().body(Matchers.containsString("\"authUrl\": \"https://mykeycloakadmin.org:8443\"")); when().get("https://mykeycloak.org:8443/realms/master/protocol/openid-connect/auth?client_id=security-admin-console&redirect_uri=https://mykeycloakadmin.org:8443/admin/master/console&state=02234324-d91e-4bf2-8396-57498e96b12a&response_mode=fragment&response_type=code&scope=openid&nonce=f8f3812e-e349-4bbf-8d15-cbba4927f5e5&code_challenge=7qjD_v11WGkt1ig-ZFHxJdrEvuTlzjFRgRGQ_5ADcko&code_challenge_method=S256").then().body(Matchers.containsString("Sign in to your account")); - when().get("http://localhost:8080/admin/master/console").then().body(Matchers.containsString("\"authUrl\": \"http://mykeycloakadmin.org:8080\"")); + when().get("http://localhost:8080/admin/master/console/").then().body(Matchers.containsString("\"authUrl\": \"http://mykeycloakadmin.org:8080\"")); } @Test @Launch({"start", "--hostname=mykeycloak.org", "--hostname-debug=true"}) public void testHostnameAdminFromHeaders() { - when().get("https://mykeycloak.org:8443/admin/master/console").then().body(Matchers.containsString("\"authUrl\": \"https://mykeycloak.org:8443\"")); + when().get("https://mykeycloak.org:8443/admin/master/console/").then().body(Matchers.containsString("\"authUrl\": \"https://mykeycloak.org:8443\"")); when().get("https://mykeycloak.org:8443/realms/master/protocol/openid-connect/auth?client_id=security-admin-console&redirect_uri=https://mykeycloak.org:8443/admin/master/console&state=02234324-d91e-4bf2-8396-57498e96b12a&response_mode=fragment&response_type=code&scope=openid&nonce=f8f3812e-e349-4bbf-8d15-cbba4927f5e5&code_challenge=7qjD_v11WGkt1ig-ZFHxJdrEvuTlzjFRgRGQ_5ADcko&code_challenge_method=S256").then().body(Matchers.containsString("Sign in to your account")); // Admin URL should be resolved from headers - when().get("http://localhost:8080/admin/master/console").then().body(Matchers.containsString("\"authUrl\": \"http://localhost:8080\"")); + when().get("http://localhost:8080/admin/master/console/").then().body(Matchers.containsString("\"authUrl\": \"http://localhost:8080\"")); when().get("http://localhost:8080/realms/master/protocol/openid-connect/auth?client_id=security-admin-console&redirect_uri=http://localhost:8080/admin/master/console&state=02234324-d91e-4bf2-8396-57498e96b12a&response_mode=fragment&response_type=code&scope=openid&nonce=f8f3812e-e349-4bbf-8d15-cbba4927f5e5&code_challenge=7qjD_v11WGkt1ig-ZFHxJdrEvuTlzjFRgRGQ_5ADcko&code_challenge_method=S256").then().body(Matchers.containsString("Sign in to your account")); Consumer assertDebugAdmin = (url) -> { @@ -202,8 +209,8 @@ public class HostnameDistTest { @Test @Launch({ "start", "--proxy=edge", "--hostname=mykeycloak.org", "--hostname-admin-url=http://mykeycloakadmin.org:1234" }) public void testAdminUrl() { - when().get("https://mykeycloak.org:8443").then().body(Matchers.containsString("http://mykeycloakadmin.org:1234/admin/")); - when().get("http://localhost:8080/admin/master/console").then().body(Matchers.containsString("\"authUrl\": \"http://mykeycloakadmin.org:1234\"")); + when().get("https://mykeycloak.org:8443").then().header(HttpHeaders.LOCATION, Matchers.containsString("http://mykeycloakadmin.org:1234/admin/")); + when().get("http://localhost:8080/admin/master/console/").then().body(Matchers.containsString("\"authUrl\": \"http://mykeycloakadmin.org:1234\"")); } @Test diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ProxyDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ProxyDistTest.java index e7e8771e15..32f5a1b341 100644 --- a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ProxyDistTest.java +++ b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ProxyDistTest.java @@ -17,27 +17,33 @@ package org.keycloak.it.cli.dist; -import static io.restassured.RestAssured.given; -import static io.restassured.RestAssured.when; -import static org.hamcrest.Matchers.containsString; - +import io.quarkus.test.junit.main.Launch; +import io.restassured.RestAssured; +import io.restassured.config.RedirectConfig; +import io.restassured.config.RestAssuredConfig; +import org.apache.http.HttpHeaders; import org.junit.Assert; import org.junit.jupiter.api.BeforeAll; import org.junit.jupiter.api.Test; import org.keycloak.it.junit5.extension.DistributionTest; import org.keycloak.it.junit5.extension.RawDistOnly; +import org.keycloak.it.junit5.extension.WithEnvVars; import org.keycloak.protocol.oidc.representations.OIDCConfigurationRepresentation; -import io.quarkus.test.junit.main.Launch; -import io.restassured.RestAssured; +import static io.restassured.RestAssured.given; +import static io.restassured.RestAssured.when; +import static org.hamcrest.Matchers.containsString; @DistributionTest(keepAlive = true, enableTls = true) +@WithEnvVars({"KEYCLOAK_ADMIN", "admin123", "KEYCLOAK_ADMIN_PASSWORD", "admin123"}) @RawDistOnly(reason = "Containers are immutable") public class ProxyDistTest { @BeforeAll public static void onBeforeAll() { RestAssured.useRelaxedHTTPSValidation(); + RestAssuredConfig config = RestAssured.config; + RestAssured.config = config.redirect(RedirectConfig.redirectConfig().followRedirects(false)); } @Test @@ -106,33 +112,36 @@ public class ProxyDistTest { @Test @Launch({ "start-dev", "--hostname-url=http://mykeycloak.org:1234", "--hostname-admin-url=http://mykeycloakadmin.127.0.0.1.nip.io:1234", "--proxy=edge" }) public void testIgnoreForwardedHeadersWhenFrontendUrlSet() { - given().header("X-Forwarded-Host", "test").when().get("http://mykeycloak.org:8080").then().body(containsString("http://mykeycloakadmin.127.0.0.1.nip.io:1234/admin")); - given().header("X-Forwarded-Proto", "https").when().get("http://localhost:8080").then().body(containsString("http://mykeycloakadmin.127.0.0.1.nip.io:1234/admin")); + given().header("X-Forwarded-Host", "test").when().get("http://mykeycloak.org:8080").then().header(HttpHeaders.LOCATION, containsString("http://mykeycloakadmin.127.0.0.1.nip.io:1234/admin")); + given().header("X-Forwarded-Proto", "https").when().get("http://localhost:8080").then().header(HttpHeaders.LOCATION, containsString("http://mykeycloakadmin.127.0.0.1.nip.io:1234/admin")); } private void assertForwardedHeader() { - given().header("Forwarded", "for=12.34.56.78;host=test:1234;proto=https, for=23.45.67.89").when().get("http://mykeycloak.org:8080").then().body(containsString("https://test:1234/admin")); + given() + .header("Forwarded", "for=12.34.56.78;host=test:1234;proto=https, for=23.45.67.89") + .when().get("http://mykeycloak.org:8080") + .then().header(HttpHeaders.LOCATION, containsString("https://test:1234/admin")); } private void assertForwardedHeaderIsIgnored() { - given().header("Forwarded", "for=12.34.56.78;host=test:1234;proto=https, for=23.45.67.89").when().get("http://localhost:8080").then().body(containsString("http://localhost:8080")); + given().header("Forwarded", "for=12.34.56.78;host=test:1234;proto=https, for=23.45.67.89").when().get("http://localhost:8080").then().header(HttpHeaders.LOCATION, containsString("http://localhost:8080")); } private void assertXForwardedHeaders() { - given().header("X-Forwarded-Host", "test").when().get("http://mykeycloak.org:8080").then().body(containsString("http://test:8080/admin")); - given().header("X-Forwarded-Host", "test").when().get("http://localhost:8080").then().body(containsString("http://test:8080/admin")); - given().header("X-Forwarded-Host", "test").when().get("https://localhost:8443").then().body(containsString("https://test:8443/admin")); + given().header("X-Forwarded-Host", "test").when().get("http://mykeycloak.org:8080").then().header(HttpHeaders.LOCATION, containsString("http://test:8080/admin")); + given().header("X-Forwarded-Host", "test").when().get("http://localhost:8080").then().header(HttpHeaders.LOCATION, containsString("http://test:8080/admin")); + given().header("X-Forwarded-Host", "test").when().get("https://localhost:8443").then().header(HttpHeaders.LOCATION, containsString("https://test:8443/admin")); //given().header("X-Forwarded-Host", "mykeycloak.org").when().get("https://localhost:8443/admin/master/console").then().body(containsString("