tegwick
3b72834bca
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 43s
Closes gap G09: five loosely related defects. lldap-export took the service account password on argv, where ps exposes it to any local user and shell history and process accounting capture it. It now prefers KEYCAPE_LLDAP_BIND_PW or --bind-pw-file; --bind-pw still works but warns, deprecated rather than removed because existing runbooks use it and breaking them silently would be worse than one more cycle of exposure. Conflicting sources are rejected instead of silently ranked, since an operator otherwise cannot tell which bind was attempted. Both migration scripts pass the password by environment now. The canonical export, generated LDIF and Keycloak realm were written 0644. None carries credential material, but the snapshot is every username, display name, email and group membership in the estate, and it tends to land in /tmp. All three are 0600. The image packaged keycape alone, so the validator and migration binaries needed a Go toolchain on the host -- which defeats shipping an image for the cutover work they exist to support. All five ship; the issuer stays the entrypoint. Verified by building the image and running each binary inside it. The publish workflow named 92.205.130.254:32166 while the cluster runs forgejo.coulomb.social/coulomb/key-cape. It now defaults to the recorded name and stays overridable by a repository variable. This repository cannot verify that the runner resolves that hostname or that the registry credentials are valid for it; if the next publish fails, set the REGISTRY variable back to the address. docker-compose.dev.yml mounts a private key and Authelia material that are correctly absent from the checkout. scripts/bootstrap-dev.sh generates them locally under a restrictive umask rather than chmodding afterwards, so the key is never briefly world-readable. Everything it writes is git-ignored. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P Assistant: claude-code Assistant-Model: opus Assistant-Process: 713576@bnt-lap001 Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6
62 lines
2.4 KiB
Bash
Executable file
62 lines
2.4 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# test-scenario-c.sh — Scenario C: Full expansion (LLDAP→OpenLDAP + KeyCape→Keycloak)
|
|
#
|
|
# This script verifies the full migration path:
|
|
# LLDAP → canonical → OpenLDAP (directory migration)
|
|
# KeyCape → canonical → Keycloak (IAM migration)
|
|
# privacyIDEA MFA remains stable (no re-enrollment)
|
|
#
|
|
# Prerequisites: docker, docker compose
|
|
|
|
set -euo pipefail
|
|
|
|
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "$REPO_ROOT"
|
|
|
|
echo "=== Scenario C: Full Expansion Test ==="
|
|
|
|
# Step 1: Export canonical data from LLDAP
|
|
echo "--- Step 1: Export canonical data ---"
|
|
# The password goes through the environment: argv is visible to any local
|
|
# user via ps (KEY-WP-0026).
|
|
KEYCAPE_LLDAP_BIND_PW="${LLDAP_BIND_PW:-adminpassword}" \
|
|
./bin/lldap-export \
|
|
--url "${LLDAP_URL:-ldap://localhost:3890}" \
|
|
--bind-dn "${LLDAP_BIND_DN:-cn=admin,ou=people,dc=netkingdom,dc=local}" \
|
|
--base-dn "dc=netkingdom,dc=local" \
|
|
--output /tmp/canonical-export.yaml
|
|
|
|
# Step 2a: Generate LDIF for OpenLDAP
|
|
echo "--- Step 2a: Generate OpenLDAP LDIF ---"
|
|
./bin/lldap-to-ldap \
|
|
--input /tmp/canonical-export.yaml \
|
|
--target openldap \
|
|
--basedn "dc=netkingdom,dc=local" \
|
|
--output /tmp/migration.ldif
|
|
|
|
# Step 2b: Transform to Keycloak realm
|
|
echo "--- Step 2b: Transform to Keycloak realm ---"
|
|
./bin/keycape-to-keycloak \
|
|
--input /tmp/canonical-export.yaml \
|
|
--realm netkingdom \
|
|
--issuer "${ISSUER:-https://auth.netkingdom.local}" \
|
|
--output /tmp/keycloak-realm-import.json
|
|
|
|
# Step 3: Start OpenLDAP + Keycloak
|
|
echo "--- Step 3: Start expanded stack ---"
|
|
docker compose -f docker-compose.scenario-c.yml up -d openldap keycloak
|
|
echo "Waiting for OpenLDAP..."
|
|
timeout 60 bash -c 'until ldapsearch -x -H ldap://localhost:389 -b dc=netkingdom,dc=local > /dev/null 2>&1; do sleep 3; done'
|
|
echo "Waiting for Keycloak..."
|
|
timeout 120 bash -c 'until curl -sf http://localhost:8080/realms/netkingdom/.well-known/openid-configuration > /dev/null; do sleep 3; done'
|
|
|
|
# Step 4: Import LDIF into OpenLDAP
|
|
echo "--- Step 4: Import LDIF ---"
|
|
ldapadd -x -H ldap://localhost:389 -D "cn=admin,dc=netkingdom,dc=local" -w adminpassword -f /tmp/migration.ldif
|
|
|
|
# Step 5: Run profile tests against Keycloak + OpenLDAP
|
|
echo "--- Step 5: Run profile tests ---"
|
|
KEYCAPE_TEST_ISSUER="http://localhost:8080/realms/netkingdom" \
|
|
go -C src test ./tests/conformance/... -v -count=1
|
|
|
|
echo "=== Scenario C PASSED ==="
|