Repository navigation
Conversation
Mint isolated Keycloak user and service account assertions with the Keystone token endpoint as their audience. Package the fixture as an opt-in Skaffold verification step for issue openstack-experimental#1366. Signed-off-by: Zebang Li <99422132+Mark101001@users.noreply.github.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Refs #1366.
Add a test fixture that obtains real Keycloak JWTs for a user and a service account. The test creates a temporary Keycloak realm and cleans it up after issuance. It is available through the opt-in
keycloak-exchange-fixtureSkaffold profile without Selenium.For example, if Keystone discovery advertises
http://keystone-rs.local/v4/oauth2/default/token, the fixture configures Keycloak to make that exact URL the sole audience of both JWTs. It checks the issuer, username, distinct subject and token IDs, and a short lifetime. This prepares realistic inputs for the exchange test.The
/tokenexchange and identity-mapping assertions depend on #1018. This draft does not enable the fixture in the defaultk3s-testrun.Test plan
keycloak_token_exchangeintegration target withcargo test --locked -p test_federation --test keycloak_token_exchange --no-run.