tegwick
7534552754
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 36s
Closes the runnable half of gap G04. The Scenario B and C scripts could not execute: absent compose files, binaries sought at src/bin where the Makefile builds to bin/, --base-dn passed to a generator whose flag is --basedn, and a hardcoded workstation Go path invoked from outside the module. Repairing the shell alone would have proved nothing. Both scripts set KEYCAPE_TEST_ISSUER while the profile suite built its own httptest server and never read it, so they passed identically whether or not a provider was running. A harness that cannot fail for the reason it exists is worse than a missing one. src/tests/conformance targets the issuer named by KEYCAPE_TEST_ISSUER over HTTP: discovery, the profile authorization surface, published keys parsed under the runtime's own rules, excluded grants, and -- with credentials -- a real token exchange verified against those keys. It skips when the variable is unset, so make test is unchanged. Run against Keycloak 26.0 rather than asserted to work. Discovery, authorization surface and key checks passed, and a client_credentials exchange produced a token that verified against Keycloak's published JWKS through internal/jose. It also failed, correctly: stock Keycloak advertises the excluded implicit and password grants, and in Keycloak those are server capabilities rather than per-client toggles, so no emitted realm removes them. A migrated Keycloak has a wider grant surface than KeyCape, which substantiates with evidence what SCOPE previously asserted without it. Scenario B legitimately reports failure today. Directory migration, credential and MFA preservation and relying-party behaviour remain unexercised, and Scenario C has never been run end to end, so G04 does not fully close. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P Assistant: claude-code Assistant-Model: opus Assistant-Process: 713576@bnt-lap001 Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6
31 lines
964 B
YAML
31 lines
964 B
YAML
# Scenario C: directory swap — OpenLDAP replaces LLDAP, Keycloak replaces KeyCape.
|
|
#
|
|
# The LDIF and realm JSON are produced by scripts/test-scenario-c.sh before this
|
|
# stack starts. OpenLDAP imports any LDIF mounted into its bootstrap directory.
|
|
services:
|
|
openldap:
|
|
image: bitnami/openldap:2.6
|
|
environment:
|
|
- LDAP_ROOT=dc=netkingdom,dc=local
|
|
- LDAP_ADMIN_USERNAME=admin
|
|
- LDAP_ADMIN_PASSWORD=adminpassword
|
|
- LDAP_SKIP_DEFAULT_TREE=yes
|
|
- LDAP_CUSTOM_LDIF_DIR=/ldifs
|
|
volumes:
|
|
- ./build/scenario-c/ldif:/ldifs:ro
|
|
ports:
|
|
- "1389:1389"
|
|
|
|
keycloak:
|
|
image: quay.io/keycloak/keycloak:26.0
|
|
command: ["start-dev", "--import-realm"]
|
|
environment:
|
|
- KC_BOOTSTRAP_ADMIN_USERNAME=admin
|
|
- KC_BOOTSTRAP_ADMIN_PASSWORD=admin
|
|
- KC_HEALTH_ENABLED=true
|
|
volumes:
|
|
- ./build/scenario-c/realm:/opt/keycloak/data/import:ro
|
|
ports:
|
|
- "8080:8080"
|
|
depends_on:
|
|
- openldap
|