Skip to content
This repository was archived by the owner on Apr 22, 2024. It is now read-only.

Commit 4ed3e51

Browse files
nacxnacx
committed
Use http-echo to log the returned tokens in e2e tests
1 parent 90319de commit 4ed3e51

9 files changed

+83
-29
lines changed

‎e2e/istio/cluster/manifests/authservice.yaml

+4-1
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,10 @@ data:
120120
"cookie_name_prefix": "authservice",
121121
"id_token": {
122122
"preamble": "Bearer",
123-
"header": "Authorization"
123+
"header": "authorization"
124+
},
125+
"access_token": {
126+
"header": "x-access-token"
124127
},
125128
"redis_session_store_config": {
126129
"server_uri": "redis://redis.redis.svc.cluster.local:6379"

‎e2e/keycloak/authz-config.json

+3
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,9 @@
1818
"preamble": "Bearer",
1919
"header": "authorization"
2020
},
21+
"access_token": {
22+
"header": "x-access-token"
23+
},
2124
"logout": {
2225
"path": "/logout",
2326
"redirect_uri": "https://host.docker.internal:9443/realms/master/protocol/openid-connect/logout"

‎e2e/keycloak/docker-compose.yaml

+8-3
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,8 @@
1515
version: "3.9"
1616

1717
services:
18-
# This is the main backend service. It returns a fixed HTTP 200 response.
19-
# It is configured to serve on port 443, and to use the ext-authz filter
20-
# to intercept all requests.
18+
# This is a proxy that intercepts requests to the target application and calls the authservice to
19+
# perform the OIDC authorization check.
2120
envoy:
2221
depends_on:
2322
ext-authz:
@@ -35,6 +34,12 @@ services:
3534
source: certs
3635
target: /etc/envoy/certs
3736

37+
# This is a simple HTTP server that will be used as the target application for the tests.
38+
http-echo:
39+
image: jmalloc/echo-server:0.3.6
40+
platform: linux/${ARCH:-amd64}
41+
hostname: http-echo
42+
3843
# idp-proxy is a proxy that will be used to forward traffic to the external authorization server
3944
# Set the OIDC config `proxy_url` to `http://idp-proxy:9000` in the `authservice` config to use this proxy.
4045
idp-proxy:

‎e2e/keycloak/envoy-config.yaml

+20-4
Original file line numberDiff line numberDiff line change
@@ -37,10 +37,8 @@ static_resources:
3737
routes:
3838
- match:
3939
prefix: "/"
40-
direct_response:
41-
status: 200
42-
body:
43-
inline_string: "Access allowed\n"
40+
route:
41+
cluster: http_echo
4442
http_filters:
4543
- name: envoy.filters.http.ext_authz
4644
typed_config:
@@ -86,3 +84,21 @@ static_resources:
8684
socket_address:
8785
address: ext-authz
8886
port_value: 10003
87+
- name: http_echo
88+
connect_timeout: 0.25s
89+
type: LOGICAL_DNS
90+
lb_policy: ROUND_ROBIN
91+
typed_extension_protocol_options:
92+
envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
93+
"@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
94+
explicit_http_config:
95+
http2_protocol_options: {}
96+
load_assignment:
97+
cluster_name: http_echo
98+
endpoints:
99+
- lb_endpoints:
100+
- endpoint:
101+
address:
102+
socket_address:
103+
address: http-echo
104+
port_value: 8080

‎e2e/keycloak/keycloak_test.go

+8-7
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ var (
4545
}
4646

4747
idpProxyService = "idp-proxy"
48+
okPayload = "Request served by http-echo"
4849
)
4950

5051
func TestOIDCUsesTheConfiguredProxy(t *testing.T) {
@@ -101,7 +102,7 @@ func TestOIDC(t *testing.T) {
101102
body, err := io.ReadAll(res.Body)
102103
require.NoError(t, err)
103104
require.Equal(t, http.StatusOK, res.StatusCode)
104-
require.Contains(t, string(body), "Access allowed")
105+
require.Contains(t, string(body), okPayload)
105106
}
106107

107108
func TestOIDCRefreshTokens(t *testing.T) {
@@ -128,7 +129,7 @@ func TestOIDCRefreshTokens(t *testing.T) {
128129
body, err := io.ReadAll(res.Body)
129130
require.NoError(t, err)
130131
require.Equal(t, http.StatusOK, res.StatusCode)
131-
require.Contains(t, string(body), "Access allowed")
132+
require.Contains(t, string(body), okPayload)
132133

133134
// Access tokens should expire in 10 seconds (tried with 5, but keycloak setup fails)
134135
// Let's perform a request now and after 10 seconds to verify that the access token is refreshed
@@ -140,7 +141,7 @@ func TestOIDCRefreshTokens(t *testing.T) {
140141
body, err = io.ReadAll(res.Body)
141142
require.NoError(t, err)
142143
require.Equal(t, http.StatusOK, res.StatusCode)
143-
require.Contains(t, string(body), "Access allowed")
144+
require.Contains(t, string(body), okPayload)
144145
})
145146

146147
t.Log("waiting for access token to expire...")
@@ -153,7 +154,7 @@ func TestOIDCRefreshTokens(t *testing.T) {
153154
body, err = io.ReadAll(res.Body)
154155
require.NoError(t, err)
155156
require.Equal(t, http.StatusOK, res.StatusCode)
156-
require.Contains(t, string(body), "Access allowed")
157+
require.Contains(t, string(body), okPayload)
157158
})
158159
}
159160

@@ -184,7 +185,7 @@ func TestOIDCLogout(t *testing.T) {
184185
body, err := io.ReadAll(res.Body)
185186
require.NoError(t, err)
186187
require.Equal(t, http.StatusOK, res.StatusCode)
187-
require.Contains(t, string(body), "Access allowed")
188+
require.Contains(t, string(body), okPayload)
188189
})
189190

190191
t.Run("second request works without login redirect", func(t *testing.T) {
@@ -195,7 +196,7 @@ func TestOIDCLogout(t *testing.T) {
195196
body, err := io.ReadAll(res.Body)
196197
require.NoError(t, err)
197198
require.Equal(t, http.StatusOK, res.StatusCode)
198-
require.Contains(t, string(body), "Access allowed")
199+
require.Contains(t, string(body), okPayload)
199200
})
200201

201202
t.Run("logout", func(t *testing.T) {
@@ -233,6 +234,6 @@ func TestOIDCLogout(t *testing.T) {
233234
body, err := io.ReadAll(res.Body)
234235
require.NoError(t, err)
235236
require.Equal(t, http.StatusOK, res.StatusCode)
236-
require.Contains(t, string(body), "Access allowed")
237+
require.Contains(t, string(body), okPayload)
237238
})
238239
}

‎e2e/legacy/authz-config.json

+3
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,9 @@
2323
"preamble": "Bearer",
2424
"header": "authorization"
2525
},
26+
"access_token": {
27+
"header": "x-access-token"
28+
},
2629
"logout": {
2730
"path": "/logout",
2831
"redirect_uri": "https://host.docker.internal:9443/realms/master/protocol/openid-connect/logout"

‎e2e/legacy/docker-compose.yaml

+8-3
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,8 @@
1515
version: "3.9"
1616

1717
services:
18-
# This is the main backend service. It returns a fixed HTTP 200 response.
19-
# It is configured to serve on port 443, and to use the ext-authz filter
20-
# to intercept all requests.
18+
# This is a proxy that intercepts requests to the target application and calls the authservice to
19+
# perform the OIDC authorization check.
2120
envoy:
2221
depends_on:
2322
ext-authz:
@@ -35,6 +34,12 @@ services:
3534
source: certs
3635
target: /etc/envoy/certs
3736

37+
# This is a simple HTTP server that will be used as the target application for the tests.
38+
http-echo:
39+
image: jmalloc/echo-server:0.3.6
40+
platform: linux/${ARCH:-amd64}
41+
hostname: http-echo
42+
3843
# This is the `authservice` image that should be up-to-date when running the tests.
3944
ext-authz:
4045
depends_on:

‎e2e/legacy/envoy-config.yaml

+20-4
Original file line numberDiff line numberDiff line change
@@ -37,10 +37,8 @@ static_resources:
3737
routes:
3838
- match:
3939
prefix: "/"
40-
direct_response:
41-
status: 200
42-
body:
43-
inline_string: "Access allowed\n"
40+
route:
41+
cluster: http_echo
4442
http_filters:
4543
- name: envoy.filters.http.ext_authz
4644
typed_config:
@@ -86,3 +84,21 @@ static_resources:
8684
socket_address:
8785
address: ext-authz
8886
port_value: 10003
87+
- name: http_echo
88+
connect_timeout: 0.25s
89+
type: LOGICAL_DNS
90+
lb_policy: ROUND_ROBIN
91+
typed_extension_protocol_options:
92+
envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
93+
"@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
94+
explicit_http_config:
95+
http2_protocol_options: {}
96+
load_assignment:
97+
cluster_name: http_echo
98+
endpoints:
99+
- lb_endpoints:
100+
- endpoint:
101+
address:
102+
socket_address:
103+
address: http-echo
104+
port_value: 8080

‎e2e/legacy/legacy_test.go

+9-7
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,8 @@ var (
4343
"host.docker.internal:9443": "localhost:9443", // Keycloak
4444
"host.docker.internal:8443": "localhost:8443", // Target application
4545
}
46+
47+
okPayload = "Request served by http-echo"
4648
)
4749

4850
func TestOIDC(t *testing.T) {
@@ -69,7 +71,7 @@ func TestOIDC(t *testing.T) {
6971
body, err := io.ReadAll(res.Body)
7072
require.NoError(t, err)
7173
require.Equal(t, http.StatusOK, res.StatusCode)
72-
require.Contains(t, string(body), "Access allowed")
74+
require.Contains(t, string(body), okPayload)
7375
}
7476

7577
func TestOIDCRefreshTokens(t *testing.T) {
@@ -96,7 +98,7 @@ func TestOIDCRefreshTokens(t *testing.T) {
9698
body, err := io.ReadAll(res.Body)
9799
require.NoError(t, err)
98100
require.Equal(t, http.StatusOK, res.StatusCode)
99-
require.Contains(t, string(body), "Access allowed")
101+
require.Contains(t, string(body), okPayload)
100102

101103
// Access tokens should expire in 10 seconds (tried with 5, but keycloak setup fails)
102104
// Let's perform a request now and after 10 seconds to verify that the access token is refreshed
@@ -108,7 +110,7 @@ func TestOIDCRefreshTokens(t *testing.T) {
108110
body, err = io.ReadAll(res.Body)
109111
require.NoError(t, err)
110112
require.Equal(t, http.StatusOK, res.StatusCode)
111-
require.Contains(t, string(body), "Access allowed")
113+
require.Contains(t, string(body), okPayload)
112114
})
113115

114116
t.Log("waiting for access token to expire...")
@@ -121,7 +123,7 @@ func TestOIDCRefreshTokens(t *testing.T) {
121123
body, err = io.ReadAll(res.Body)
122124
require.NoError(t, err)
123125
require.Equal(t, http.StatusOK, res.StatusCode)
124-
require.Contains(t, string(body), "Access allowed")
126+
require.Contains(t, string(body), okPayload)
125127
})
126128
}
127129

@@ -151,7 +153,7 @@ func TestOIDCLogout(t *testing.T) {
151153
body, err := io.ReadAll(res.Body)
152154
require.NoError(t, err)
153155
require.Equal(t, http.StatusOK, res.StatusCode)
154-
require.Contains(t, string(body), "Access allowed")
156+
require.Contains(t, string(body), okPayload)
155157
})
156158

157159
t.Run("second request works without login redirect", func(t *testing.T) {
@@ -162,7 +164,7 @@ func TestOIDCLogout(t *testing.T) {
162164
body, err := io.ReadAll(res.Body)
163165
require.NoError(t, err)
164166
require.Equal(t, http.StatusOK, res.StatusCode)
165-
require.Contains(t, string(body), "Access allowed")
167+
require.Contains(t, string(body), okPayload)
166168
})
167169

168170
t.Run("logout", func(t *testing.T) {
@@ -200,6 +202,6 @@ func TestOIDCLogout(t *testing.T) {
200202
body, err := io.ReadAll(res.Body)
201203
require.NoError(t, err)
202204
require.Equal(t, http.StatusOK, res.StatusCode)
203-
require.Contains(t, string(body), "Access allowed")
205+
require.Contains(t, string(body), okPayload)
204206
})
205207
}

0 commit comments

Comments
 (0)