coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
key-cape/docker-compose.scenario-c.yml

33 lines
1.1 KiB
YAML
Raw Normal View History

Make the replacement harness runnable and target a live issuer Closes the runnable half of gap G04. The Scenario B and C scripts could not execute: absent compose files, binaries sought at src/bin where the Makefile builds to bin/, --base-dn passed to a generator whose flag is --basedn, and a hardcoded workstation Go path invoked from outside the module. Repairing the shell alone would have proved nothing. Both scripts set KEYCAPE_TEST_ISSUER while the profile suite built its own httptest server and never read it, so they passed identically whether or not a provider was running. A harness that cannot fail for the reason it exists is worse than a missing one. src/tests/conformance targets the issuer named by KEYCAPE_TEST_ISSUER over HTTP: discovery, the profile authorization surface, published keys parsed under the runtime's own rules, excluded grants, and -- with credentials -- a real token exchange verified against those keys. It skips when the variable is unset, so make test is unchanged. Run against Keycloak 26.0 rather than asserted to work. Discovery, authorization surface and key checks passed, and a client_credentials exchange produced a token that verified against Keycloak's published JWKS through internal/jose. It also failed, correctly: stock Keycloak advertises the excluded implicit and password grants, and in Keycloak those are server capabilities rather than per-client toggles, so no emitted realm removes them. A migrated Keycloak has a wider grant surface than KeyCape, which substantiates with evidence what SCOPE previously asserted without it. Scenario B legitimately reports failure today. Directory migration, credential and MFA preservation and relying-party behaviour remain unexercised, and Scenario C has never been run end to end, so G04 does not fully close. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P Assistant: claude-code Assistant-Model: opus Assistant-Process: 713576@bnt-lap001 Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6
2026-09-07 23:32:11 +02:00
# Scenario C: directory swap — OpenLDAP replaces LLDAP, Keycloak replaces KeyCape.
#
# The LDIF and realm JSON are produced by scripts/test-scenario-c.sh before this
# stack starts. OpenLDAP imports any LDIF mounted into its bootstrap directory.
services:
openldap:
Prove the migration against live directories and fix what that surfaced Finishes the unproven half of gap G04. Running the harness against real LLDAP, OpenLDAP and Keycloak found four defects that the full unit suite passed over. Every LLDAP user search pointed at a branch that does not exist. Config.userOU() defaulted to ou=users while LLDAP stores users under ou=people, and nothing set UserOU. LookupUser, ListUsers and ValidatePassword all derive from it, so all three silently found nothing against a stock LLDAP -- human login included, not only the export. Exposed by an export returning zero users while still emitting a membership referencing uid=admin, a snapshot the repo's own validator rejects. raw_attributes_well_formed, added one workplan earlier, rejected the LLDAP adapter's own _validation_warning annotation, so the exporter's output failed its own validation. Tooling annotations are exempt now, and a test proves the exemption does not weaken the rule. Migrated group memberships were dangling: resolveMemberDN passed a source DN through unchanged while entries were written to the target branch, so groups named entries the migrated directory does not contain. And empty groups could not load at all, since groupOfNames makes member a MUST -- they reference a placeholder entry the LDIF creates, an organizationalRole rather than a person, emitted only when some group needs it. The scenario-c compose file could not start: bitnami/openldap:2.6 does not exist, though it passed docker compose config. Pinned to the image the scenario was proved against. Proof: LLDAP -> export -> validate -> LDIF -> ldapadd into OpenLDAP 1.5.0, every entry added and every member resolving; a realm from the same export imports into Keycloak and serves discovery. KeyCape passes 5/5 conformance checks, a migrated Keycloak 4/5. Relying-party behaviour and MFA against a migrated realm remain unexercised, and credential/MFA migration is not supplied at all, so no harness can establish it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P Assistant: claude-code Assistant-Model: opus Assistant-Process: 713576@bnt-lap001 Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6
2026-09-08 00:29:34 +02:00
# osixia/openldap imports every .ldif mounted into its bootstrap directory
# at first start. Pinned: this is the image the scenario was proved against.
image: osixia/openldap:1.5.0
command: ["--copy-service"]
Make the replacement harness runnable and target a live issuer Closes the runnable half of gap G04. The Scenario B and C scripts could not execute: absent compose files, binaries sought at src/bin where the Makefile builds to bin/, --base-dn passed to a generator whose flag is --basedn, and a hardcoded workstation Go path invoked from outside the module. Repairing the shell alone would have proved nothing. Both scripts set KEYCAPE_TEST_ISSUER while the profile suite built its own httptest server and never read it, so they passed identically whether or not a provider was running. A harness that cannot fail for the reason it exists is worse than a missing one. src/tests/conformance targets the issuer named by KEYCAPE_TEST_ISSUER over HTTP: discovery, the profile authorization surface, published keys parsed under the runtime's own rules, excluded grants, and -- with credentials -- a real token exchange verified against those keys. It skips when the variable is unset, so make test is unchanged. Run against Keycloak 26.0 rather than asserted to work. Discovery, authorization surface and key checks passed, and a client_credentials exchange produced a token that verified against Keycloak's published JWKS through internal/jose. It also failed, correctly: stock Keycloak advertises the excluded implicit and password grants, and in Keycloak those are server capabilities rather than per-client toggles, so no emitted realm removes them. A migrated Keycloak has a wider grant surface than KeyCape, which substantiates with evidence what SCOPE previously asserted without it. Scenario B legitimately reports failure today. Directory migration, credential and MFA preservation and relying-party behaviour remain unexercised, and Scenario C has never been run end to end, so G04 does not fully close. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P Assistant: claude-code Assistant-Model: opus Assistant-Process: 713576@bnt-lap001 Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6
2026-09-07 23:32:11 +02:00
environment:
Prove the migration against live directories and fix what that surfaced Finishes the unproven half of gap G04. Running the harness against real LLDAP, OpenLDAP and Keycloak found four defects that the full unit suite passed over. Every LLDAP user search pointed at a branch that does not exist. Config.userOU() defaulted to ou=users while LLDAP stores users under ou=people, and nothing set UserOU. LookupUser, ListUsers and ValidatePassword all derive from it, so all three silently found nothing against a stock LLDAP -- human login included, not only the export. Exposed by an export returning zero users while still emitting a membership referencing uid=admin, a snapshot the repo's own validator rejects. raw_attributes_well_formed, added one workplan earlier, rejected the LLDAP adapter's own _validation_warning annotation, so the exporter's output failed its own validation. Tooling annotations are exempt now, and a test proves the exemption does not weaken the rule. Migrated group memberships were dangling: resolveMemberDN passed a source DN through unchanged while entries were written to the target branch, so groups named entries the migrated directory does not contain. And empty groups could not load at all, since groupOfNames makes member a MUST -- they reference a placeholder entry the LDIF creates, an organizationalRole rather than a person, emitted only when some group needs it. The scenario-c compose file could not start: bitnami/openldap:2.6 does not exist, though it passed docker compose config. Pinned to the image the scenario was proved against. Proof: LLDAP -> export -> validate -> LDIF -> ldapadd into OpenLDAP 1.5.0, every entry added and every member resolving; a realm from the same export imports into Keycloak and serves discovery. KeyCape passes 5/5 conformance checks, a migrated Keycloak 4/5. Relying-party behaviour and MFA against a migrated realm remain unexercised, and credential/MFA migration is not supplied at all, so no harness can establish it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P Assistant: claude-code Assistant-Model: opus Assistant-Process: 713576@bnt-lap001 Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6
2026-09-08 00:29:34 +02:00
- LDAP_ORGANISATION=NetKingdom
- LDAP_DOMAIN=netkingdom.local
Make the replacement harness runnable and target a live issuer Closes the runnable half of gap G04. The Scenario B and C scripts could not execute: absent compose files, binaries sought at src/bin where the Makefile builds to bin/, --base-dn passed to a generator whose flag is --basedn, and a hardcoded workstation Go path invoked from outside the module. Repairing the shell alone would have proved nothing. Both scripts set KEYCAPE_TEST_ISSUER while the profile suite built its own httptest server and never read it, so they passed identically whether or not a provider was running. A harness that cannot fail for the reason it exists is worse than a missing one. src/tests/conformance targets the issuer named by KEYCAPE_TEST_ISSUER over HTTP: discovery, the profile authorization surface, published keys parsed under the runtime's own rules, excluded grants, and -- with credentials -- a real token exchange verified against those keys. It skips when the variable is unset, so make test is unchanged. Run against Keycloak 26.0 rather than asserted to work. Discovery, authorization surface and key checks passed, and a client_credentials exchange produced a token that verified against Keycloak's published JWKS through internal/jose. It also failed, correctly: stock Keycloak advertises the excluded implicit and password grants, and in Keycloak those are server capabilities rather than per-client toggles, so no emitted realm removes them. A migrated Keycloak has a wider grant surface than KeyCape, which substantiates with evidence what SCOPE previously asserted without it. Scenario B legitimately reports failure today. Directory migration, credential and MFA preservation and relying-party behaviour remain unexercised, and Scenario C has never been run end to end, so G04 does not fully close. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P Assistant: claude-code Assistant-Model: opus Assistant-Process: 713576@bnt-lap001 Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6
2026-09-07 23:32:11 +02:00
- LDAP_ADMIN_PASSWORD=adminpassword
volumes:
Prove the migration against live directories and fix what that surfaced Finishes the unproven half of gap G04. Running the harness against real LLDAP, OpenLDAP and Keycloak found four defects that the full unit suite passed over. Every LLDAP user search pointed at a branch that does not exist. Config.userOU() defaulted to ou=users while LLDAP stores users under ou=people, and nothing set UserOU. LookupUser, ListUsers and ValidatePassword all derive from it, so all three silently found nothing against a stock LLDAP -- human login included, not only the export. Exposed by an export returning zero users while still emitting a membership referencing uid=admin, a snapshot the repo's own validator rejects. raw_attributes_well_formed, added one workplan earlier, rejected the LLDAP adapter's own _validation_warning annotation, so the exporter's output failed its own validation. Tooling annotations are exempt now, and a test proves the exemption does not weaken the rule. Migrated group memberships were dangling: resolveMemberDN passed a source DN through unchanged while entries were written to the target branch, so groups named entries the migrated directory does not contain. And empty groups could not load at all, since groupOfNames makes member a MUST -- they reference a placeholder entry the LDIF creates, an organizationalRole rather than a person, emitted only when some group needs it. The scenario-c compose file could not start: bitnami/openldap:2.6 does not exist, though it passed docker compose config. Pinned to the image the scenario was proved against. Proof: LLDAP -> export -> validate -> LDIF -> ldapadd into OpenLDAP 1.5.0, every entry added and every member resolving; a realm from the same export imports into Keycloak and serves discovery. KeyCape passes 5/5 conformance checks, a migrated Keycloak 4/5. Relying-party behaviour and MFA against a migrated realm remain unexercised, and credential/MFA migration is not supplied at all, so no harness can establish it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P Assistant: claude-code Assistant-Model: opus Assistant-Process: 713576@bnt-lap001 Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6
2026-09-08 00:29:34 +02:00
- ./build/scenario-c/ldif:/container/service/slapd/assets/config/bootstrap/ldif/custom:ro
Make the replacement harness runnable and target a live issuer Closes the runnable half of gap G04. The Scenario B and C scripts could not execute: absent compose files, binaries sought at src/bin where the Makefile builds to bin/, --base-dn passed to a generator whose flag is --basedn, and a hardcoded workstation Go path invoked from outside the module. Repairing the shell alone would have proved nothing. Both scripts set KEYCAPE_TEST_ISSUER while the profile suite built its own httptest server and never read it, so they passed identically whether or not a provider was running. A harness that cannot fail for the reason it exists is worse than a missing one. src/tests/conformance targets the issuer named by KEYCAPE_TEST_ISSUER over HTTP: discovery, the profile authorization surface, published keys parsed under the runtime's own rules, excluded grants, and -- with credentials -- a real token exchange verified against those keys. It skips when the variable is unset, so make test is unchanged. Run against Keycloak 26.0 rather than asserted to work. Discovery, authorization surface and key checks passed, and a client_credentials exchange produced a token that verified against Keycloak's published JWKS through internal/jose. It also failed, correctly: stock Keycloak advertises the excluded implicit and password grants, and in Keycloak those are server capabilities rather than per-client toggles, so no emitted realm removes them. A migrated Keycloak has a wider grant surface than KeyCape, which substantiates with evidence what SCOPE previously asserted without it. Scenario B legitimately reports failure today. Directory migration, credential and MFA preservation and relying-party behaviour remain unexercised, and Scenario C has never been run end to end, so G04 does not fully close. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P Assistant: claude-code Assistant-Model: opus Assistant-Process: 713576@bnt-lap001 Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6
2026-09-07 23:32:11 +02:00
ports:
Prove the migration against live directories and fix what that surfaced Finishes the unproven half of gap G04. Running the harness against real LLDAP, OpenLDAP and Keycloak found four defects that the full unit suite passed over. Every LLDAP user search pointed at a branch that does not exist. Config.userOU() defaulted to ou=users while LLDAP stores users under ou=people, and nothing set UserOU. LookupUser, ListUsers and ValidatePassword all derive from it, so all three silently found nothing against a stock LLDAP -- human login included, not only the export. Exposed by an export returning zero users while still emitting a membership referencing uid=admin, a snapshot the repo's own validator rejects. raw_attributes_well_formed, added one workplan earlier, rejected the LLDAP adapter's own _validation_warning annotation, so the exporter's output failed its own validation. Tooling annotations are exempt now, and a test proves the exemption does not weaken the rule. Migrated group memberships were dangling: resolveMemberDN passed a source DN through unchanged while entries were written to the target branch, so groups named entries the migrated directory does not contain. And empty groups could not load at all, since groupOfNames makes member a MUST -- they reference a placeholder entry the LDIF creates, an organizationalRole rather than a person, emitted only when some group needs it. The scenario-c compose file could not start: bitnami/openldap:2.6 does not exist, though it passed docker compose config. Pinned to the image the scenario was proved against. Proof: LLDAP -> export -> validate -> LDIF -> ldapadd into OpenLDAP 1.5.0, every entry added and every member resolving; a realm from the same export imports into Keycloak and serves discovery. KeyCape passes 5/5 conformance checks, a migrated Keycloak 4/5. Relying-party behaviour and MFA against a migrated realm remain unexercised, and credential/MFA migration is not supplied at all, so no harness can establish it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P Assistant: claude-code Assistant-Model: opus Assistant-Process: 713576@bnt-lap001 Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6
2026-09-08 00:29:34 +02:00
- "1389:389"
Make the replacement harness runnable and target a live issuer Closes the runnable half of gap G04. The Scenario B and C scripts could not execute: absent compose files, binaries sought at src/bin where the Makefile builds to bin/, --base-dn passed to a generator whose flag is --basedn, and a hardcoded workstation Go path invoked from outside the module. Repairing the shell alone would have proved nothing. Both scripts set KEYCAPE_TEST_ISSUER while the profile suite built its own httptest server and never read it, so they passed identically whether or not a provider was running. A harness that cannot fail for the reason it exists is worse than a missing one. src/tests/conformance targets the issuer named by KEYCAPE_TEST_ISSUER over HTTP: discovery, the profile authorization surface, published keys parsed under the runtime's own rules, excluded grants, and -- with credentials -- a real token exchange verified against those keys. It skips when the variable is unset, so make test is unchanged. Run against Keycloak 26.0 rather than asserted to work. Discovery, authorization surface and key checks passed, and a client_credentials exchange produced a token that verified against Keycloak's published JWKS through internal/jose. It also failed, correctly: stock Keycloak advertises the excluded implicit and password grants, and in Keycloak those are server capabilities rather than per-client toggles, so no emitted realm removes them. A migrated Keycloak has a wider grant surface than KeyCape, which substantiates with evidence what SCOPE previously asserted without it. Scenario B legitimately reports failure today. Directory migration, credential and MFA preservation and relying-party behaviour remain unexercised, and Scenario C has never been run end to end, so G04 does not fully close. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P Assistant: claude-code Assistant-Model: opus Assistant-Process: 713576@bnt-lap001 Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6
2026-09-07 23:32:11 +02:00
keycloak:
image: quay.io/keycloak/keycloak:26.0
command: ["start-dev", "--import-realm"]
environment:
- KC_BOOTSTRAP_ADMIN_USERNAME=admin
- KC_BOOTSTRAP_ADMIN_PASSWORD=admin
- KC_HEALTH_ENABLED=true
volumes:
- ./build/scenario-c/realm:/opt/keycloak/data/import:ro
ports:
- "8080:8080"
depends_on:
- openldap
Reference in a new issue Copy permalink