libre.sh/keycloak-scim
2
0
Fork 0
Code Issues 14 Pull requests Releases Packages Activity Actions 6
keycloak-scim/testsuite/integration-arquillian/HOW-TO-RUN.md
Peter Nalyvayko b2f10359c8 KEYCLOAK-4335: x509 client certificate authentication 
Started on implementing cert thumbprint validation as a part of x509 auth flow. Added a prompt screen to give users a choice to either log in based on the identity extracted from X509 cert or to continue with normal browser login flow authentication; clean up some of the comments

x509 authentication for browser and direct grant flows. Implemented certificate to user mapping based on user attribute

Implemented CRL and OCSP certificate revocation checking and added corresponding configuration settings to set up responderURI (OCSP), a location of a file containing X509CRL entries and switiches to enable/disable revocation checking; reworked the certificate validation; removed superflous logging; changed the certificate authentication prompt page to automatically log in the user after 10 seconds if no response from user is received

Support for loading CRL from LDAP directory; finished the CRL checking using the distribution points in the certificate; updated the instructions how to add X509 authentication to keycloak authentication flows; minor styling changes

Stashing x509 unit test related changes; added the steps to configure mutual SSL in WildFly to the summary document

A minor fix to throw a security exception when unable to check cert revocation status using OCSP; continue working on README

Changes to the formating of the readme

Added a list of features to readme

Fixed a potential bug in X509 cert user authenticator that may cause NPE if the client certificate does not define keyusage or extended key usage extensions

Fixed compile time errors in X509 validators caused by the changes to the user credentials model in upstream master

Removed a superfluous file created when merging x509 and main branches

X509 authentication: removed the PKIX path validation as superflous

Reverted changes to the AbstractAttributeMapper introduced during merging of x509 branch into main

Merge the unit tests from x509 branch

added mockito dependency to services project; changes to the x509 authenticators to expose methods in order to support unit tests; added a default ctor to CertificateValidator class to support unit testing; updated the direct grant and browser x509 authenticators to report consistent status messages; unit tests to validate X509 direct grant and browser authenticators; fixed OCSP validation to throw an exception if the certificate chain contains a single certificate; fixed the CRL revocation validation to only use CRL distribution point validation only if configured

CRL and OSCP mock tests using mock netty server. Changed the certificate validator to better support unit testing.

changes to the mockserver dependency to explicitly exclude xercesImpl that was causing SAMLParsingTest to fail

Added a utility class to build v3 certificates with optional extensions to facilitate X509 unit testing; removed supoerfluous certificate date validity check (undertow should be checking the certificate dates during PKIX path validation anyway)

X509: changes to make configuring the user identity extraction simplier for users - new identity sources to map certificate CN and email (E) attributes from X500 subject and issuer names directly rather than using regular expressions to parse them

X509 fixed a compile error caused by the changes to the user model in master

Integration tests to validate X509 client certificate authentication

Minor tweaks to X509 client auth related integration tests

CRLs to support x509 client cert auth integration tests

X509: reverted the changes to testrealm.json and updated the test to configure the realm at runtime

X509 - changes to the testsuite project configuration to specify a path to a trust store used to test x509 direct grant flow; integration tests to validate x509 authentication in browser and direct grant flows; updated the client certificate to extend its validatity dates; x509 integration tests and authenticators have been refactored to use a common configuration class

X509 separated the browser and direct grant x509 authenction integration tests

x509 updated the authenticator provider test to remove no longer supported cert thumbprint authenticator

x509 removed the dependency on mockito

x509 re-implemented OCSP certificate revocation client used to check revocation status when logging in with x509 certificate to work around the dependency on Sun OCSP implementation; integration tests to verify OCSP revocation requests

index.txt.attr is needed by openssl to run a simple OCSP server

x509: minor grammar fixes

Add OCSP stub responder to integration tests

This commit adds OCSP stub responder needed for the integration tests,
and eliminates the need to run external OCSP responder in order to run
the OCSP in X509OCSPResponderTest.

Replace printStackTrece with logging

This commit replaces call to printStackTrace that will end up going to
the stderr with logging statement of WARN severity.

Remove unused imports

Removed unused imports in
org.keycloak.authentication.authenticators.x509 package.

Parameterized Hashtable variable

Removed unused CertificateFactory variable

Declared serialVersionUID for Serializable class

Removed unused CertificateBuilder class

The CertificateBuilder was not used anywhere in the code, removing it to
prevent technical debt.

Removing unused variable declaration

`response` variable is not used in the test, removed it.

Made sure InputStreams are closed

Even though the InputStreams are memory based, added try-with-resources
to make sure that they are closed.

Removed deprecated usage of URLEncoder

Replaced invocation of deprecated method from URLEncoder with Encode
from Keycloak util package.

Made it more clear how to control OCSP stub responder in the tests

X509 Certificate user authentication: moved the integration unit tests into their own directory to fix a failing travis test job

KEYCLOAK-4335: reduced the logging level; added the instructions how to run X.509 related tests to HOW-TO-RUN.md doc; removed README.md from x509 folder; removed no longer used ocsp profile and fixed the exclusion filter; refactored the x509 base test class that was broken by the recent changes to the integration tests

KEYCLOAK-4335: fixed a few issues after rebasing
2017-03-17 05:24:57 -04:00

12 KiB
Raw Blame History

How To Run various testsuite configurations

Base steps

It's recomended to build the workspace including distribution.

cd $KEYCLOAK_SOURCES
mvn clean install -DskipTests=true
cd distribution
mvn clean install

Debugging - tips & tricks

Arquillian debugging

Adding this system property when running any test:

-Darquillian.debug=true

will add lots of info to the log. Especially about:

  • The test method names, which will be executed for each test class, will be written at the proper running order to the log at the beginning of each test (done by KcArquillian class).
  • All the triggered arquillian lifecycle events and executed observers listening to those events will be written to the log
  • The bootstrap of WebDriver will be unlimited. By default there is just 1 minute timeout and test is cancelled when WebDriver is not bootstrapped within it.

WebDriver timeout

By default, WebDriver has 10 seconds timeout to load every page and it timeouts with error after that. Use this to increase timeout to 1 hour instead:

-Dpageload.timeout=3600000

Surefire debugging

For debugging, the best is to run the test from IDE and debug it directly. When you use embedded Undertow (which is by default), then JUnit test, Keycloak server and adapter are all in the same JVM and you can debug them easily. If it is not an option and you are forced to test with Maven and Wildfly (or EAP), you can use this:

-Dmaven.surefire.debug=true

and you will be able to attach remote debugger to the test. Unfortunately server and adapter are running in different JVMs, so this won't help to debug those.

TODO: Improve and add more info about Wildfly debugging...

Testsuite logging

It is configured in testsuite/integration-arquillian/tests/base/src/test/resources/log4j.properties . You can see that logging of testsuite itself (category org.keycloak.testsuite) is debug by default.

When you run tests with undertow (which is by default), there is logging for Keycloak server and adapter (category org.keycloak ) in info when you run tests from IDE, but off when you run tests with maven. The reason is that, we don't want huge logs when running mvn build. However using system property keycloak.logging.level will override it. This can be used for both IDE or maven. So for example using -Dkeycloak.logging.level=debug will enable debug logging for keycloak server and adapter.

For more fine-tuning of individual categories, you can look at log4j.properties file and temporarily enable/disable them here.

TODO: Add info about Wildfly logging

Run adapter tests

Wildfly

# Prepare servers
mvn -f testsuite/integration-arquillian/servers/pom.xml clean install \
   -Pauth-server-wildfly \
   -Papp-server-wildfly

# Run tests
mvn -f testsuite/integration-arquillian/tests/other/adapters/jboss/wildfly/pom.xml \
   clean install \
   -Pauth-server-wildfly \
   -Papp-server-wildfly

JBoss Fuse 6.3

  1. Download JBoss Fuse 6.3 to your filesystem. It can be downloaded from http://origin-repository.jboss.org/nexus/content/groups/m2-proxy/org/jboss/fuse/jboss-fuse-karaf Assumed you downloaded jboss-fuse-karaf-6.3.0.redhat-229.zip

  2. Install to your local maven repository and change the properties according to your env (This step can be likely avoided if you somehow configure your local maven settings to point directly to Fuse repo):

    mvn install:install-file
    -DgroupId=org.jboss.fuse
    -DartifactId=jboss-fuse-karaf
    -Dversion=6.3.0.redhat-229
    -Dpackaging=zip
    -Dfile=/mydownloads/jboss-fuse-karaf-6.3.0.redhat-229.zip

  3. Prepare Fuse and run the tests (change props according to your environment, versions etc):

    Prepare Fuse server

    mvn -f testsuite/integration-arquillian/servers
    clean install
    -Pauth-server-wildfly
    -Papp-server-fuse63
    -Dfuse63.version=6.3.0.redhat-229
    -Dapp.server.karaf.update.config=true
    -Dmaven.local.settings=$HOME/.m2/settings.xml
    -Drepositories=,http://download.eng.bos.redhat.com/brewroot/repos/sso-7.1-build/latest/maven/
    -Dmaven.repo.local=$HOME/.m2/repository

    Run the Fuse adapter tests

    mvn -f testsuite/integration-arquillian/tests/other/adapters/karaf/fuse63/pom.xml
    clean install
    -Pauth-server-wildfly
    -Papp-server-fuse63
    -Dfuse63.version=6.3.0.redhat-229

EAP6 with Hawtio

  1. Download JBoss EAP 6.4.0.GA zip

  2. Install to your local maven repository and change the properties according to your env (This step can be likely avoided if you somehow configure your local maven settings to point directly to EAP repo):

    mvn install:install-file
    -DgroupId=org.jboss.as
    -DartifactId=jboss-as-dist
    -Dversion=7.5.0.Final-redhat-21
    -Dpackaging=zip
    -Dfile=/mydownloads/jboss-eap-6.4.0.zip

  3. Download Fuse EAP installer (for example from http://origin-repository.jboss.org/nexus/content/groups/m2-proxy/com/redhat/fuse/eap/fuse-eap-installer/6.3.0.redhat-220/ )

  4. Install previously downloaded file manually

    mvn install:install-file
    -DgroupId=com.redhat.fuse.eap
    -DartifactId=fuse-eap-installer
    -Dversion=6.3.0.redhat-220
    -Dpackaging=jar
    -Dfile=/fuse-eap-installer-6.3.0.redhat-220.jar

  5. Prepare EAP6 with Hawtio and run the test

    Prepare EAP6 and deploy hawtio

    mvn -f testsuite/integration-arquillian/servers
    clean install
    -Pauth-server-wildfly
    -Papp-server-eap6-fuse
    -Dapp.server.jboss.version=7.5.0.Final-redhat-21
    -Dfuse.installer.version=6.3.0.redhat-220

    Run the test

    mvn -f testsuite/integration-arquillian/tests/other/adapters/jboss/eap6-fuse/pom.xml
    clean install
    -Pauth-server-wildfly
    -Papp-server-eap6-fuse

Migration test

DB migration test

This test will:

  • start Keycloak 1.9.8
  • import realm and some data to MySQL DB
  • stop Keycloak 1.9.8
  • start latest KEycloak, which automatically updates DB from 1.9.8
  • Do some test that data are correct

  1. Prepare MySQL DB and ensure that MySQL DB is empty. See ../../misc/DatabaseTesting.md for some hints for locally prepare Docker MySQL image.

  2. Run the test (Update according to your DB connection, versions etc):

    export DB_HOST=localhost

    mvn -f testsuite/integration-arquillian/pom.xml
    clean install
    -Pauth-server-wildfly,jpa,clean-jpa,auth-server-migration
    -Dtest=MigrationTest
    -Dmigration.mode=auto
    -Dmigrated.auth.server.version=1.9.8.Final
    -Djdbc.mvn.groupId=mysql
    -Djdbc.mvn.version=5.1.29
    -Djdbc.mvn.artifactId=mysql-connector-java
    -Dkeycloak.connectionsJpa.url=jdbc:mysql://$DB_HOST/keycloak
    -Dkeycloak.connectionsJpa.user=keycloak
    -Dkeycloak.connectionsJpa.password=keycloak

JSON export/import migration test

This will start latest Keycloak and import the realm JSON file, which was previously exported from Keycloak 1.9.8.Final

mvn -f testsuite/integration-arquillian/pom.xml \
  clean install \
  -Pauth-server-wildfly,migration-import \
  -Dtest=MigrationTest \
  -Dmigration.mode=import \
  -Dmigrated.auth.server.version=1.9.8.Final

UI tests

The UI tests are real-life, UI focused integration tests. Hence they do not support the default HtmlUnit browser. Only the following real-life browsers are supported: Mozilla Firefox, Google Chrome and Internet Explorer. For details on how to run the tests with these browsers, please refer to Different Browsers chapter.

The UI tests are focused on the Admin Console as well as on some login scenarios. They are placed in the console module and are disabled by default.

The tests also use some constants placed in test-constants.properties. A different file can be specified by -Dtestsuite.constants=path/to/different-test-constants.properties

Execution example

mvn -f testsuite/integration-arquillian/tests/other/console/pom.xml \
    clean test \
    -Dbrowser=firefox \
    -Dfirefox_binary=/opt/firefox-45.1.1esr/firefox

Welcome Page tests

The Welcome Page tests need to be run on WildFly/EAP and with -Dskip.add.user.json switch. So that they are disabled by default and are meant to be run separately.

# Prepare servers
mvn -f testsuite/integration-arquillian/servers/pom.xml \
    clean install \
    -Pauth-server-wildfly \
    -Papp-server-wildfly

# Run tests
mvn -f testsuite/integration-arquillian/tests/base/pom.xml \
    clean test \
    -Dtest=WelcomePageTest \
    -Dskip.add.user.json \
    -Pauth-server-wildfly

Social Login

The social login tests require setup of all social networks including an example social user. These details can't be shared as it would result in the clients and users eventually being blocked. By default these tests are skipped.

To run the full test you need to configure clients in Google, Facebook, GitHub, Twitter, LinkedIn, Microsoft and StackOverflow. See the server administration guide for details on how to do that. Further, you also need to create a sample user that can login to the social network.

The details should be added to a standard properties file. For some properties you can use shared common properties and override when needed. Or you can specify these for all providers. All providers require at least clientId and clientSecret (StackOverflow also requires clientKey).

An example social.properties file looks like:

common.username=sampleuser@example.org
common.password=commonpassword
common.profile.firstName=Foo
common.profile.lastName=Bar
common.profile.email=sampleuser@example.org

google.clientId=asdfasdfasdfasdfsadf
google.clientSecret=zxcvzxcvzxcvzxcv

facebook.clientId=asdfasdfasdfasdfsadf
facebook.clientSecret=zxcvzxcvzxcvzxcv
facebook.profile.lastName=Test

In the example above the common username, password and profile are shared for all providers, but Facebook has a different last name.

Some providers actively block bots so you need to use a proper browser to test. Either Firefox or Chrome should work.

To run the tests run:

mvn -f testsuite/integration-arquillian/pom.xml \
      clean install \
      -Pauth-server-wildfly \
      -Dtest=SocialLoginTest \
      -Dbrowser=chrome \
      -Dsocial.config=/path/to/social.properties

Different Browsers

Mozilla Firefox

  • Supported version: latest ESR (Extended Support Release)
  • Driver download required: no
  • Run with: -Dbrowser=firefox; optionally you can specify -Dfirefox_binary=path/to/firefox/binary

Google Chrome

  • Supported version: latest stable
  • Driver download required: ChromeDriver which corresponds with your version of the browser
  • Run with: -Dbrowser=chrome -Dwebdriver.chrome.driver=path/to/chromedriver

Internet Explorer

Run X.509 tests

To run the X.509 client certificate authentication tests:

mvn -f testsuite/integration-arquillian/pom.xml \
      clean install \
  -Pauth-server-wildfly \
  -Dauth.server.ssl.required \
  -Dbrowser=phantomjs \
  "-Dtest=*.x509.*"