coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Make the replacement harness runnable and target a live issuer
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 36s
Details

Browse source 
Closes the runnable half of gap G04. The Scenario B and C scripts could not
execute: absent compose files, binaries sought at src/bin where the Makefile
builds to bin/, --base-dn passed to a generator whose flag is --basedn, and a
hardcoded workstation Go path invoked from outside the module.

Repairing the shell alone would have proved nothing. Both scripts set
KEYCAPE_TEST_ISSUER while the profile suite built its own httptest server and
never read it, so they passed identically whether or not a provider was running.
A harness that cannot fail for the reason it exists is worse than a missing one.

src/tests/conformance targets the issuer named by KEYCAPE_TEST_ISSUER over HTTP:
discovery, the profile authorization surface, published keys parsed under the
runtime's own rules, excluded grants, and -- with credentials -- a real token
exchange verified against those keys. It skips when the variable is unset, so
make test is unchanged.

Run against Keycloak 26.0 rather than asserted to work. Discovery, authorization
surface and key checks passed, and a client_credentials exchange produced a token
that verified against Keycloak's published JWKS through internal/jose.

It also failed, correctly: stock Keycloak advertises the excluded implicit and
password grants, and in Keycloak those are server capabilities rather than
per-client toggles, so no emitted realm removes them. A migrated Keycloak has a
wider grant surface than KeyCape, which substantiates with evidence what SCOPE
previously asserted without it. Scenario B legitimately reports failure today.

Directory migration, credential and MFA preservation and relying-party behaviour
remain unexercised, and Scenario C has never been run end to end, so G04 does not
fully close.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 713576@bnt-lap001
Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6
This commit is contained in:
tegwick 2026-09-07 23:32:11 +02:00
parent ebc48e31ae
commit 7534552754
8 changed files with 511 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

26
history/2026-09-05-011726-scope-intent-assessment.md
View file

@ -217,6 +217,32 @@ profile tests exercise the external Keycloak issuer.
exercise actual replacement providers, directory migration, claims and MFA;
record unchanged relying-party behavior and explicit migration limitations.
**Status 2026-09-07 (KEY-WP-0022): partially closed.** The harness now runs. The
shell prerequisites are fixed (root `bin/`, `--basedn`, module-relative `go -C
src`, prerequisite checks before anything starts), the two missing compose files
exist and pass `docker compose config`, and `src/tests/conformance` reads
`KEYCAPE_TEST_ISSUER` and exercises a running issuer over HTTP — discovery,
profile authorization surface, published keys parsed under the runtime's own
rules, and, with credentials, a real token exchange verified against those keys.
It skips when the variable is unset, so `make test` is unchanged.
It was run against an actual Keycloak 26.0, not only asserted to work: discovery,
authorization surface and key checks passed, and a `client_credentials` exchange
against a created service client produced a token that verified against
Keycloak's published JWKS through `internal/jose`.
**Finding that bears on the replacement claim:** stock Keycloak fails
`TestExcludedGrantsAreNotAdvertised`. Its discovery advertises `implicit` and
`password` alongside the profile's grants, and those are server capabilities in
Keycloak rather than per-client toggles, so no realm configuration removes them.
A migrated Keycloak therefore presents a wider grant surface than KeyCape does.
This substantiates with evidence what SCOPE already said was unestablished, and
means Scenario B legitimately reports a failure today rather than a green run.
Still open: directory migration against a live OpenLDAP, credential and MFA
preservation, and unchanged relying-party behaviour are not exercised. Scenario C
has never been run end to end. G04 does not fully close.
### G05 — Directory export can omit data without reporting it
**Priority: medium. Kind: implementation gap.**