tegwick
7534552754
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 36s
Closes the runnable half of gap G04. The Scenario B and C scripts could not execute: absent compose files, binaries sought at src/bin where the Makefile builds to bin/, --base-dn passed to a generator whose flag is --basedn, and a hardcoded workstation Go path invoked from outside the module. Repairing the shell alone would have proved nothing. Both scripts set KEYCAPE_TEST_ISSUER while the profile suite built its own httptest server and never read it, so they passed identically whether or not a provider was running. A harness that cannot fail for the reason it exists is worse than a missing one. src/tests/conformance targets the issuer named by KEYCAPE_TEST_ISSUER over HTTP: discovery, the profile authorization surface, published keys parsed under the runtime's own rules, excluded grants, and -- with credentials -- a real token exchange verified against those keys. It skips when the variable is unset, so make test is unchanged. Run against Keycloak 26.0 rather than asserted to work. Discovery, authorization surface and key checks passed, and a client_credentials exchange produced a token that verified against Keycloak's published JWKS through internal/jose. It also failed, correctly: stock Keycloak advertises the excluded implicit and password grants, and in Keycloak those are server capabilities rather than per-client toggles, so no emitted realm removes them. A migrated Keycloak has a wider grant surface than KeyCape, which substantiates with evidence what SCOPE previously asserted without it. Scenario B legitimately reports failure today. Directory migration, credential and MFA preservation and relying-party behaviour remain unexercised, and Scenario C has never been run end to end, so G04 does not fully close. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P Assistant: claude-code Assistant-Model: opus Assistant-Process: 713576@bnt-lap001 Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6
60 lines
2.3 KiB
Bash
Executable file
60 lines
2.3 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# test-scenario-c.sh — Scenario C: Full expansion (LLDAP→OpenLDAP + KeyCape→Keycloak)
|
|
#
|
|
# This script verifies the full migration path:
|
|
# LLDAP → canonical → OpenLDAP (directory migration)
|
|
# KeyCape → canonical → Keycloak (IAM migration)
|
|
# privacyIDEA MFA remains stable (no re-enrollment)
|
|
#
|
|
# Prerequisites: docker, docker compose
|
|
|
|
set -euo pipefail
|
|
|
|
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "$REPO_ROOT"
|
|
|
|
echo "=== Scenario C: Full Expansion Test ==="
|
|
|
|
# Step 1: Export canonical data from LLDAP
|
|
echo "--- Step 1: Export canonical data ---"
|
|
./bin/lldap-export \
|
|
--url "${LLDAP_URL:-ldap://localhost:3890}" \
|
|
--bind-dn "${LLDAP_BIND_DN:-cn=admin,ou=people,dc=netkingdom,dc=local}" \
|
|
--bind-pw "${LLDAP_BIND_PW:-adminpassword}" \
|
|
--base-dn "dc=netkingdom,dc=local" \
|
|
--output /tmp/canonical-export.yaml
|
|
|
|
# Step 2a: Generate LDIF for OpenLDAP
|
|
echo "--- Step 2a: Generate OpenLDAP LDIF ---"
|
|
./bin/lldap-to-ldap \
|
|
--input /tmp/canonical-export.yaml \
|
|
--target openldap \
|
|
--basedn "dc=netkingdom,dc=local" \
|
|
--output /tmp/migration.ldif
|
|
|
|
# Step 2b: Transform to Keycloak realm
|
|
echo "--- Step 2b: Transform to Keycloak realm ---"
|
|
./bin/keycape-to-keycloak \
|
|
--input /tmp/canonical-export.yaml \
|
|
--realm netkingdom \
|
|
--issuer "${ISSUER:-https://auth.netkingdom.local}" \
|
|
--output /tmp/keycloak-realm-import.json
|
|
|
|
# Step 3: Start OpenLDAP + Keycloak
|
|
echo "--- Step 3: Start expanded stack ---"
|
|
docker compose -f docker-compose.scenario-c.yml up -d openldap keycloak
|
|
echo "Waiting for OpenLDAP..."
|
|
timeout 60 bash -c 'until ldapsearch -x -H ldap://localhost:389 -b dc=netkingdom,dc=local > /dev/null 2>&1; do sleep 3; done'
|
|
echo "Waiting for Keycloak..."
|
|
timeout 120 bash -c 'until curl -sf http://localhost:8080/realms/netkingdom/.well-known/openid-configuration > /dev/null; do sleep 3; done'
|
|
|
|
# Step 4: Import LDIF into OpenLDAP
|
|
echo "--- Step 4: Import LDIF ---"
|
|
ldapadd -x -H ldap://localhost:389 -D "cn=admin,dc=netkingdom,dc=local" -w adminpassword -f /tmp/migration.ldif
|
|
|
|
# Step 5: Run profile tests against Keycloak + OpenLDAP
|
|
echo "--- Step 5: Run profile tests ---"
|
|
KEYCAPE_TEST_ISSUER="http://localhost:8080/realms/netkingdom" \
|
|
go -C src test ./tests/conformance/... -v -count=1
|
|
|
|
echo "=== Scenario C PASSED ==="
|