-
Notifications
You must be signed in to change notification settings - Fork 12
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #77 from kstekovi/EAP7-1796
EAP7-1796 - Add the ability to secure the management console with OIDC
- Loading branch information
Showing
9 changed files
with
2,533 additions
and
47 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
56 changes: 56 additions & 0 deletions
56
packages/testsuite/cypress/e2e/elytron-oidc-client/test-oidc-security-rbac.cy.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| describe("TESTS: Access secured by Elytron OIDC client with RBAC", () => { | ||
| let wildfly: string; | ||
| let keycloak: string; | ||
|
|
||
| before(() => { | ||
| cy.startWildflyContainerSecured() | ||
| .then((result) => { | ||
| wildfly = result as string; | ||
| console.log(wildfly); | ||
| }) | ||
| .then(() => { | ||
| cy.startKeycloakContainer().then((result) => { | ||
| keycloak = result as string; | ||
| // the following CLI commands secure the web-console by OIDC, with RBAC enabled | ||
| cy.executeInWildflyContainer( | ||
| `"/subsystem=elytron-oidc-client/provider=keycloak:add(provider-url=${keycloak}/realms/wildfly-infra), | ||
| /subsystem=elytron-oidc-client/secure-deployment=wildfly-management:add(provider=keycloak,client-id=wildfly-management,principal-attribute=preferred_username,bearer-only=true,ssl-required=EXTERNAL), | ||
| /subsystem=elytron-oidc-client/secure-server=wildfly-console:add(provider=keycloak,client-id=wildfly-console,public-client=true), | ||
| /core-service=management/access=authorization:write-attribute(name=provider,value=rbac), | ||
| /core-service=management/access=authorization:write-attribute(name=use-identity-roles,value=true), | ||
| reload"` | ||
| ); | ||
| }); | ||
| }); | ||
| }); | ||
|
|
||
| after(() => { | ||
| cy.task("stop:containers"); | ||
| }); | ||
|
|
||
| it("Logs in successfully and logs out by user with role", () => { | ||
| cy.visit(`/?connect=${wildfly}#home`); | ||
| cy.get("#username").type("userwithrole"); | ||
| cy.get("#password").type("password"); | ||
| cy.get("#kc-login").click(); | ||
| cy.verifyUserName("userwithrole"); | ||
| cy.verifyUserRole("Administrator"); | ||
| cy.logoutFromWebConsole(); | ||
| verifyNotLoggedIn(keycloak); | ||
| }); | ||
|
|
||
| it("Returns 403 Forbidden for a user without role", () => { | ||
| cy.visit(`/?connect=${wildfly}#home`); | ||
| cy.get("#username").type("userwithoutrole"); | ||
| cy.get("#password").type("password"); | ||
| cy.get("#kc-login").click(); | ||
| cy.verifyErrorMessage("Status 403 - Forbidden."); | ||
| }); | ||
|
|
||
| function verifyNotLoggedIn(keycloak: string): void { | ||
| cy.url().should(`include`, keycloak); | ||
| cy.get("#username").should("exist"); | ||
| cy.get("#password").should("exist"); | ||
| cy.get("#kc-login").should("exist"); | ||
| } | ||
| }); |
53 changes: 53 additions & 0 deletions
53
packages/testsuite/cypress/e2e/elytron-oidc-client/test-oidc-security.cy.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| describe("TESTS: Access secured by Elytron OIDC client", () => { | ||
| let wildfly: string; | ||
| let keycloak: string; | ||
|
|
||
| before(() => { | ||
| cy.startWildflyContainerSecured() | ||
| .then((result) => { | ||
| wildfly = result as string; | ||
| }) | ||
| .then(() => { | ||
| cy.startKeycloakContainer().then((result) => { | ||
| keycloak = result as string; | ||
| // the following CLI commands setup the OIDC configuration | ||
| cy.executeInWildflyContainer( | ||
| `"/subsystem=elytron-oidc-client/provider=keycloak:add(provider-url=${keycloak}/realms/wildfly-infra), | ||
| /subsystem=elytron-oidc-client/secure-deployment=wildfly-management:add(provider=keycloak,client-id=wildfly-management,principal-attribute=preferred_username,bearer-only=true,ssl-required=EXTERNAL), | ||
| /subsystem=elytron-oidc-client/secure-server=wildfly-console:add(provider=keycloak,client-id=wildfly-console,public-client=true), | ||
| reload"` | ||
| ); | ||
| }); | ||
| }); | ||
| }); | ||
|
|
||
| after(() => { | ||
| cy.task("stop:containers"); | ||
| }); | ||
|
|
||
| it("Logs in successfully and logs out", () => { | ||
| cy.visit(`?connect=${wildfly}#home`); | ||
| cy.get("#username").type("userwithoutrole"); | ||
| cy.get("#password").type("password"); | ||
| cy.get("#kc-login").click(); | ||
| cy.url().should(`include`, `localhost:${Cypress.env("HAL_CONTAINER_PORT") as string}`); | ||
| cy.verifyUserName("userwithoutrole"); | ||
| cy.logoutFromWebConsole(); | ||
| verifyNotLoggedIn(keycloak); | ||
| }); | ||
|
|
||
| it("Fails to log in with bad credentials", () => { | ||
| cy.visit(`?connect=${wildfly}#home`); | ||
| cy.get("#username").type("userwithoutrole"); | ||
| cy.get("#password").type("wrongPassword"); | ||
| cy.get("#kc-login").click(); | ||
| verifyNotLoggedIn(keycloak); | ||
| }); | ||
|
|
||
| function verifyNotLoggedIn(keycloak: string): void { | ||
| cy.url().should(`include`, keycloak); | ||
| cy.get("#username").should("exist"); | ||
| cy.get("#password").should("exist"); | ||
| cy.get("#kc-login").should("exist"); | ||
| } | ||
| }); |
Oops, something went wrong.