Skip to content

Commit b787b6a

Browse files
xekxek
committed
[federation] Add OIDC authentication flows tests
This adds support for testing all OIDC authentication methods: - v3oidcpassword (Resource Owner Password Credentials) - v3oidcclientcredentials (Client Credentials) - v3oidcaccesstoken (Access Token Reuse) - v3oidcauthcode (Authorization Code) Note: v3oidcdeviceauthz requires Python 3.10+ and is not available in OSP18 which ships with Python 3.9. Signed-off-by: Grzegorz Grasza <[email protected]>
1 parent 892ffec commit b787b6a

File tree

11 files changed

+795
-11
lines changed

11 files changed

+795
-11
lines changed

‎docs/dictionary/en-custom.txt‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
aaabbcc
22
abcdefghij
3+
accesstoken
34
addr
45
afuscoar
56
alertmanager
@@ -22,6 +23,7 @@ arx
2223
arxcruz
2324
AssignedTeam
2425
auth
26+
authcode
2527
authfile
2628
autoconfiguration
2729
autohold
@@ -87,6 +89,7 @@ cjeanner
8789
ckcg
8890
cli
8991
client
92+
clientcredentials
9093
clusterimageset
9194
clusterpool
9295
ClusterServiceVersion
@@ -145,6 +148,7 @@ dest
145148
dev
146149
devscripts
147150
devsetup
151+
deviceauthz
148152
dfb
149153
dfce
150154
dfg
@@ -279,11 +283,15 @@ junos
279283
jxe
280284
jzxbol
281285
kcgpby
286+
kctestuser1
287+
kctestuser2
282288
keepalived
283289
kerberos
284290
keycloak
285291
keypair
286292
keyring
293+
keystoneauth
294+
keystoneauth1
287295
keytab
288296
kinit
289297
kni
@@ -356,6 +364,7 @@ mtu
356364
multiline
357365
multinode
358366
multipath
367+
multirealm
359368
multus
360369
myorg
361370
mytest
@@ -399,6 +408,10 @@ nzgdh
399408
oauth
400409
observability
401410
oidc
411+
oidcaccesstoken
412+
oidcauthcode
413+
oidcclientcredentials
414+
oidcpassword
402415
oc
403416
ocp
404417
ocpbm
@@ -603,6 +616,11 @@ usr
603616
UTF
604617
utils
605618
uuid
619+
v3oidcaccesstoken
620+
v3oidcauthcode
621+
v3oidcclientcredentials
622+
v3oidcdeviceauthz
623+
v3oidcpassword
606624
vbibob
607625
vbmc
608626
vcgvuc

‎roles/federation/README.md‎

Lines changed: 149 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,150 @@
1-
federation
2-
=========
1+
# federation
32

4-
This role will setup Openstack for user federation. The keycloak system will be used for the IdP provider.
3+
This role sets up OpenStack Keystone federation with Keycloak (Red Hat SSO) as the Identity Provider.
4+
5+
## Overview
6+
7+
The federation role configures:
8+
- Keycloak realm(s) with test users and groups
9+
- Keystone Identity Provider and protocol configuration
10+
- OIDC authentication for OpenStack CLI
11+
- Comprehensive authentication testing
12+
13+
## Supported OIDC Authentication Methods
14+
15+
This role supports testing all OIDC authentication methods available in keystoneauth1:
16+
17+
| Plugin Name | Description | Status |
18+
|-------------|-------------|--------|
19+
| `v3oidcpassword` | Resource Owner Password Credentials flow | ✅ Supported |
20+
| `v3oidcclientcredentials` | Client Credentials flow | ✅ Supported |
21+
| `v3oidcaccesstoken` | Reuse existing access token | ✅ Supported |
22+
| `v3oidcauthcode` | Authorization Code flow | ✅ Supported |
23+
| `v3oidcdeviceauthz` | Device Authorization flow (RFC 8628) | ⚠️ Requires Python 3.10+ |
24+
25+
## Variables
26+
27+
### Infrastructure Configuration
28+
29+
| Variable | Default | Description |
30+
|----------|---------|-------------|
31+
| `cifmw_federation_keycloak_namespace` | `openstack` | Kubernetes namespace for Keycloak |
32+
| `cifmw_federation_run_osp_cmd_namespace` | `openstack` | Kubernetes namespace for openstackclient |
33+
| `cifmw_federation_domain` | - | Base domain for service URLs |
34+
35+
### Keycloak Configuration
36+
37+
| Variable | Default | Description |
38+
|----------|---------|-------------|
39+
| `cifmw_federation_keycloak_realm` | `openstack` | Primary Keycloak realm name |
40+
| `cifmw_federation_keycloak_realm2` | `openstack2` | Secondary realm (multirealm mode) |
41+
| `cifmw_federation_keycloak_admin_username` | `admin` | Keycloak admin username |
42+
| `cifmw_federation_keycloak_admin_password` | `nomoresecrets` | Keycloak admin password |
43+
| `cifmw_federation_deploy_multirealm` | `false` | Deploy multiple realms |
44+
45+
### Test Users
46+
47+
| Variable | Default | Description |
48+
|----------|---------|-------------|
49+
| `cifmw_federation_keycloak_testuser1_username` | `kctestuser1` | Test user 1 username |
50+
| `cifmw_federation_keycloak_testuser1_password` | `nomoresecrets1` | Test user 1 password |
51+
| `cifmw_federation_keycloak_testuser2_username` | `kctestuser2` | Test user 2 username |
52+
| `cifmw_federation_keycloak_testuser2_password` | `nomoresecrets2` | Test user 2 password |
53+
54+
### Keystone Integration
55+
56+
| Variable | Default | Description |
57+
|----------|---------|-------------|
58+
| `cifmw_federation_IdpName` | `kcIDP` | Identity Provider name in Keystone |
59+
| `cifmw_federation_keystone_domain` | `SSO` | Keystone domain for federated users |
60+
| `cifmw_federation_mapping_name` | `SSOmap` | Keystone mapping name |
61+
| `cifmw_federation_project_name` | `SSOproject` | Project for federated users |
62+
| `cifmw_federation_group_name` | `SSOgroup` | Group for federated users |
63+
64+
### OIDC Client Configuration
65+
66+
| Variable | Default | Description |
67+
|----------|---------|-------------|
68+
| `cifmw_federation_keystone_OIDC_ClientID` | `rhoso` | OIDC client ID |
69+
| `cifmw_federation_keystone_OIDC_ClientSecret` | `COX8bmlKAWn56XCGMrKQJj7dgHNAOl6f` | OIDC client secret |
70+
| `cifmw_federation_keystone_OIDC_Scope` | `openid email profile` | OIDC scopes |
71+
72+
### Testing Configuration
73+
74+
| Variable | Default | Description |
75+
|----------|---------|-------------|
76+
| `cifmw_federation_run_oidc_auth_tests` | `true` | Run OIDC auth tests |
77+
78+
## Task Files
79+
80+
### Main Tasks
81+
82+
- `hook_pre_deploy.yml` - Deploys Keycloak before OpenStack
83+
- `hook_post_deploy.yml` - Configures federation after OpenStack deployment
84+
- `hook_controlplane_config.yml` - Adds federation config to control plane
85+
86+
### Setup Tasks
87+
88+
- `run_keycloak_setup.yml` - Deploy Keycloak operator and instance
89+
- `run_keycloak_realm_setup.yml` - Configure Keycloak realm, users, and client
90+
- `run_keycloak_client_setup.yml` - Enable advanced client features (Service Accounts, Device Auth)
91+
- `run_openstack_setup.yml` - Configure Keystone IdP and mappings
92+
- `run_openstack_auth_setup.yml` - Deploy authentication scripts to openstackclient pod
93+
94+
### Test Tasks
95+
96+
- `run_openstack_auth_test.yml` - Basic v3oidcpassword authentication test
97+
- `run_openstack_oidc_auth_tests.yml` - Comprehensive OIDC authentication test suite
98+
99+
## Authentication Scripts
100+
101+
The following scripts are deployed to `/home/cloud-admin/` in the openstackclient pod:
102+
103+
| Script | Description |
104+
|--------|-------------|
105+
| `get-token.sh <user>` | Get token using v3oidcpassword |
106+
| `oidc-clientcredentials.sh` | Configure v3oidcclientcredentials auth |
107+
| `oidc-accesstoken.sh <token>` | Configure v3oidcaccesstoken auth |
108+
| `oidc-authcode.sh <code>` | Configure v3oidcauthcode auth |
109+
| `get-keycloak-token.sh` | Helper to obtain tokens from Keycloak |
110+
111+
### Example Usage
112+
113+
```bash
114+
# v3oidcpassword - Password flow
115+
kubectl exec -n openstack openstackclient -- bash -c \
116+
'source /home/cloud-admin/kctestuser1 && openstack token issue'
117+
118+
# v3oidcclientcredentials - Client Credentials flow
119+
kubectl exec -n openstack openstackclient -- bash -c \
120+
'source /home/cloud-admin/oidc-clientcredentials.sh && openstack token issue'
121+
122+
# v3oidcaccesstoken - Access Token flow
123+
ACCESS_TOKEN=$(/home/cloud-admin/get-keycloak-token.sh access_token kctestuser1 nomoresecrets1)
124+
kubectl exec -n openstack openstackclient -- bash -c \
125+
"source /home/cloud-admin/oidc-accesstoken.sh '$ACCESS_TOKEN' && openstack token issue"
126+
127+
# v3oidcauthcode - Authorization Code flow
128+
AUTH_CODE=$(/home/cloud-admin/get-keycloak-token.sh auth_code kctestuser1 nomoresecrets1)
129+
kubectl exec -n openstack openstackclient -- bash -c \
130+
"source /home/cloud-admin/oidc-authcode.sh '$AUTH_CODE' && openstack token issue"
131+
```
132+
133+
## Test Execution
134+
135+
The OIDC authentication tests are automatically run during the `hook_post_deploy.yml` phase when `cifmw_federation_run_oidc_auth_tests` is `true` (default).
136+
137+
To run the tests manually:
138+
139+
```yaml
140+
- name: Run OIDC authentication tests
141+
ansible.builtin.include_role:
142+
name: federation
143+
tasks_from: run_openstack_oidc_auth_tests.yml
144+
```
145+
146+
## Notes
147+
148+
- **Device Authorization Flow**: The `v3oidcdeviceauthz` plugin requires keystoneauth1 with Python 3.10+ support. OSP18 ships with Python 3.9 and does not include this plugin.
149+
- **Multirealm**: CLI-based OIDC authentication testing only works in single realm mode. Multirealm federation is supported for Horizon-based authentication.
150+
- **Keycloak Client**: The role automatically enables Service Accounts and Device Authorization on the Keycloak client to support all authentication methods.

‎roles/federation/defaults/main.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -147,3 +147,20 @@ cifmw_federation_keystone_idp1_provider_filename: "keycloak-{{ cifmw_federation_
147147
cifmw_federation_keystone_idp2_conf_filename: "keycloak-{{ cifmw_federation_keycloak_namespace }}.{{ cifmw_federation_domain }}%2Fauth%2Frealms%2F{{ cifmw_federation_keycloak_realm2 }}.conf"
148148
cifmw_federation_keystone_idp2_client_filename: "keycloak-{{ cifmw_federation_keycloak_namespace }}.{{ cifmw_federation_domain }}%2Fauth%2Frealms%2F{{ cifmw_federation_keycloak_realm2 }}.client"
149149
cifmw_federation_keystone_idp2_provider_filename: "keycloak-{{ cifmw_federation_keycloak_namespace }}.{{ cifmw_federation_domain }}%2Fauth%2Frealms%2F{{ cifmw_federation_keycloak_realm2 }}.provider"
150+
151+
# =============================================================================
152+
# OIDC AUTHENTICATION TESTING
153+
# =============================================================================
154+
# Configuration for OIDC authentication method testing
155+
#
156+
# When enabled, tests all supported OIDC authentication methods:
157+
# - v3oidcpassword: Resource Owner Password Credentials flow
158+
# - v3oidcclientcredentials: Client Credentials flow
159+
# - v3oidcaccesstoken: Access Token Reuse flow
160+
# - v3oidcauthcode: Authorization Code flow
161+
#
162+
# Note: v3oidcdeviceauthz (Device Authorization flow) requires Python 3.10+
163+
# and is not available in OSP18.
164+
165+
# Enable/disable OIDC authentication method tests
166+
cifmw_federation_run_oidc_auth_tests: true

‎roles/federation/tasks/hook_post_deploy.yml‎

Lines changed: 21 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -68,13 +68,26 @@
6868

6969
# MultiRole CLI testing is not available. It is only currently supported in Horizon.
7070
# Auth tests only run in single realm mode - not supported in multirealm
71-
- name: Run federation OSP User Auth test for first realm
71+
72+
# =============================================================================
73+
# OIDC Authentication Methods Testing
74+
# =============================================================================
75+
# Tests all supported OIDC authentication methods when enabled.
76+
# This requires Keycloak client to be configured for Service Accounts
77+
# and Device Authorization.
78+
79+
- name: Configure Keycloak client for OIDC auth methods
7280
ansible.builtin.include_role:
7381
name: federation
74-
tasks_from: run_openstack_auth_test.yml
75-
vars:
76-
cifmw_federation_keycloak_testuser_username: "{{ item }}"
77-
loop:
78-
- "{{ cifmw_federation_keycloak_testuser1_username }}"
79-
- "{{ cifmw_federation_keycloak_testuser2_username }}"
80-
when: not cifmw_federation_deploy_multirealm|bool
82+
tasks_from: run_keycloak_client_setup.yml
83+
when:
84+
- not cifmw_federation_deploy_multirealm | bool
85+
- cifmw_federation_run_oidc_auth_tests | default(true) | bool
86+
87+
- name: Run OIDC authentication method tests
88+
ansible.builtin.include_role:
89+
name: federation
90+
tasks_from: run_openstack_oidc_auth_tests.yml
91+
when:
92+
- not cifmw_federation_deploy_multirealm | bool
93+
- cifmw_federation_run_oidc_auth_tests | default(true) | bool

0 commit comments

Comments
 (0)