nixos/tests/keycloak.nix

   1 # This tests Keycloak: it starts the service, creates a realm with an
   2 # OIDC client and a user, and simulates the user logging in to the
   3 # client using their Keycloak login.
   4
   5 let
   6   certs = import ./common/acme/server/snakeoil-certs.nix;
   7   frontendUrl = "https://${certs.domain}";
   8
   9   keycloakTest = import ./make-test-python.nix (
  10     { pkgs, databaseType, ... }:
  11     let
  12       initialAdminPassword = "h4Iho\"JFn't2>iQIR9";
  13       adminPasswordFile = pkgs.writeText "admin-password" "${initialAdminPassword}";
  14     in
  15     {
  16       name = "keycloak";
  17       meta = with pkgs.lib.maintainers; {
  18         maintainers = [ talyz ];
  19       };
  20
  21       nodes = {
  22         keycloak = { config, ... }: {
  23           security.pki.certificateFiles = [
  24             certs.ca.cert
  25           ];
  26
  27           networking.extraHosts = ''
  28             127.0.0.1 ${certs.domain}
  29           '';
  30
  31           services.keycloak = {
  32             enable = true;
  33             settings = {
  34               hostname = certs.domain;
  35             };
  36             inherit initialAdminPassword;
  37             sslCertificate = "${certs.${certs.domain}.cert}";
  38             sslCertificateKey = "${certs.${certs.domain}.key}";
  39             database = {
  40               type = databaseType;
  41               username = "bogus";
  42               name = "also bogus";
  43               passwordFile = "${pkgs.writeText "dbPassword" ''wzf6\"vO"Cb\nP>p#6;c&o?eu=q'THE'''H''''E''}";
  44             };
  45             plugins = with config.services.keycloak.package.plugins; [
  46               keycloak-discord
  47               keycloak-metrics-spi
  48             ];
  49           };
  50           environment.systemPackages = with pkgs; [
  51             xmlstarlet
  52             html-tidy
  53             jq
  54           ];
  55         };
  56       };
  57
  58       testScript =
  59         let
  60           client = {
  61             clientId = "test-client";
  62             name = "test-client";
  63             redirectUris = [ "urn:ietf:wg:oauth:2.0:oob" ];
  64           };
  65
  66           user = {
  67             firstName = "Chuck";
  68             lastName = "Testa";
  69             username = "chuck.testa";
  70             email = "chuck.testa@example.com";
  71           };
  72
  73           password = "password1234";
  74
  75           realm = {
  76             enabled = true;
  77             realm = "test-realm";
  78             clients = [ client ];
  79             users = [(
  80               user // {
  81                 enabled = true;
  82                 credentials = [{
  83                   type = "password";
  84                   temporary = false;
  85                   value = password;
  86                 }];
  87               }
  88             )];
  89           };
  90
  91           realmDataJson = pkgs.writeText "realm-data.json" (builtins.toJSON realm);
  92
  93           jqCheckUserinfo = pkgs.writeText "check-userinfo.jq" ''
  94             if {
  95               "firstName": .given_name,
  96               "lastName": .family_name,
  97               "username": .preferred_username,
  98               "email": .email
  99             } != ${builtins.toJSON user} then
 100               error("Wrong user info!")
 101             else
 102               empty
 103             end
 104           '';
 105         in ''
 106           keycloak.start()
 107           keycloak.wait_for_unit("keycloak.service")
 108           keycloak.wait_for_open_port(443)
 109           keycloak.wait_until_succeeds("curl -sSf ${frontendUrl}")
 110
 111           ### Realm Setup ###
 112
 113           # Get an admin interface access token
 114           keycloak.succeed("""
 115               curl -sSf -d 'client_id=admin-cli' \
 116                    -d 'username=admin' \
 117                    -d "password=$(<${adminPasswordFile})" \
 118                    -d 'grant_type=password' \
 119                    '${frontendUrl}/realms/master/protocol/openid-connect/token' \
 120                    | jq -r '"Authorization: bearer " + .access_token' >admin_auth_header
 121           """)
 122
 123           # Register the metrics SPI
 124           keycloak.succeed(
 125               """${pkgs.jre}/bin/keytool -import -alias snakeoil -file ${certs.ca.cert} -storepass aaaaaa -keystore cacert.jks -noprompt""",
 126               """KC_OPTS='-Djavax.net.ssl.trustStore=cacert.jks -Djavax.net.ssl.trustStorePassword=aaaaaa' kcadm.sh config credentials --server '${frontendUrl}' --realm master --user admin --password "$(<${adminPasswordFile})" """,
 127               """KC_OPTS='-Djavax.net.ssl.trustStore=cacert.jks -Djavax.net.ssl.trustStorePassword=aaaaaa' kcadm.sh update events/config -s 'eventsEnabled=true' -s 'adminEventsEnabled=true' -s 'eventsListeners+=metrics-listener'""",
 128               """curl -sSf '${frontendUrl}/realms/master/metrics' | grep '^keycloak_admin_event_UPDATE'"""
 129           )
 130
 131           # Publish the realm, including a test OIDC client and user
 132           keycloak.succeed(
 133               "curl -sSf -H @admin_auth_header -X POST -H 'Content-Type: application/json' -d @${realmDataJson} '${frontendUrl}/admin/realms/'"
 134           )
 135
 136           # Generate and save the client secret. To do this we need
 137           # Keycloak's internal id for the client.
 138           keycloak.succeed(
 139               "curl -sSf -H @admin_auth_header '${frontendUrl}/admin/realms/${realm.realm}/clients?clientId=${client.name}' | jq -r '.[].id' >client_id",
 140               "curl -sSf -H @admin_auth_header -X POST '${frontendUrl}/admin/realms/${realm.realm}/clients/'$(<client_id)'/client-secret' | jq -r .value >client_secret",
 141           )
 142
 143
 144           ### Authentication Testing ###
 145
 146           # Start the login process by sending an initial request to the
 147           # OIDC authentication endpoint, saving the returned page. Tidy
 148           # up the HTML (XmlStarlet is picky) and extract the login form
 149           # post url.
 150           keycloak.succeed(
 151               "curl -sSf -c cookie '${frontendUrl}/realms/${realm.realm}/protocol/openid-connect/auth?client_id=${client.name}&redirect_uri=urn%3Aietf%3Awg%3Aoauth%3A2.0%3Aoob&scope=openid+email&response_type=code&response_mode=query&nonce=qw4o89g3qqm' >login_form",
 152               "tidy -asxml -q -m login_form || true",
 153               "xml sel -T -t -m \"_:html/_:body/_:div/_:div/_:div/_:div/_:div/_:div/_:form[@id='kc-form-login']\" -v @action login_form >form_post_url",
 154           )
 155
 156           # Post the login form and save the response. Once again tidy up
 157           # the HTML, then extract the authorization code.
 158           keycloak.succeed(
 159               "curl -sSf -L -b cookie -d 'username=${user.username}' -d 'password=${password}' -d 'credentialId=' \"$(<form_post_url)\" >auth_code_html",
 160               "tidy -asxml -q -m auth_code_html || true",
 161               "xml sel -T -t -m \"_:html/_:body/_:div/_:div/_:div/_:div/_:div/_:input[@id='code']\" -v @value auth_code_html >auth_code",
 162           )
 163
 164           # Exchange the authorization code for an access token.
 165           keycloak.succeed(
 166               "curl -sSf -d grant_type=authorization_code -d code=$(<auth_code) -d client_id=${client.name} -d client_secret=$(<client_secret) -d redirect_uri=urn%3Aietf%3Awg%3Aoauth%3A2.0%3Aoob '${frontendUrl}/realms/${realm.realm}/protocol/openid-connect/token' | jq -r '\"Authorization: bearer \" + .access_token' >auth_header"
 167           )
 168
 169           # Use the access token on the OIDC userinfo endpoint and check
 170           # that the returned user info matches what we initialized the
 171           # realm with.
 172           keycloak.succeed(
 173               "curl -sSf -H @auth_header '${frontendUrl}/realms/${realm.realm}/protocol/openid-connect/userinfo' | jq -f ${jqCheckUserinfo}"
 174           )
 175         '';
 176     }
 177   );
 178 in
 179 {
 180   postgres = keycloakTest { databaseType = "postgresql"; };
 181   mariadb = keycloakTest { databaseType = "mariadb"; };
 182   mysql = keycloakTest { databaseType = "mysql"; };
 183 }