[FEAT] Add integration tests to detect breaking changes with new keycloak versions

InseeFr / Keycloak-FranceConnect

Extension Keycloak facilitant l'utilisation de FranceConnect

MIT License

87 stars 31 forks source link

[FEAT] Add integration tests to detect breaking changes with new keycloak versions #49

Open mboisnard opened 3 years ago

mboisnard commented 3 years ago

Is your feature request related to a problem? Please describe. We don't check if the plugin is compatible with new keycloak versions

Describe the solution you'd like

Add some integration tests (plugin is deployed, FC theme works, plugin configuration is ok, ...) using Keycloak TestContainers dependency (it starts a Keycloak container only for testing)
Retrieve Keycloak existing versions (using Docker Hub Api: https://hub.docker.com/v2/repositories/jboss/keycloak/tags/?page_size=100)
Execute tests foreach Keycloak Docker Image (from 9.0.2 to latest)
Trigger Github actions workflow every week

micedre commented 2 years ago

We could use https://github.com/dasniko/testcontainers-keycloak for this. The real stopper now is a way to test FranceConnect. We could use the test env but this requires to use fixed url for the integration test (and a way to override dns resolution).

micedre commented 2 years ago

FranceConnect and AgentConnect source here https://github.com/france-connect/sources. Maybe we can use it for integration test.

mboisnard commented 2 years ago

We could use https://github.com/dasniko/testcontainers-keycloak for this. The real stopper now is a way to test FranceConnect. We could use the test env but this requires to use fixed url for the integration test (and a way to override dns resolution).

@micedre Is it possible to configure a static localhost authorized redirect / logout uri for FC+ / AC integration accounts ? I think I can create acceptance tests with codeceptjs and selenium to configure Keycloak and start a session using FC inside an headless Chrome. I still have a pain point with Github Action to run a Keycloak container with latest FC plugin but I will find a solution :)

micedre commented 2 years ago

FC+ or AC disallow the use of localhost as authorized redirect_uri. For local tests, they recommend to use a complete domain (localhost.test or other) by modifying the hosts file.

mboisnard commented 2 years ago

Ok, is http scheme authorized? I think this Github Action can work for our usecase: https://github.com/mboisnard/Keycloak-FranceConnect/blob/master/.github/workflows/acceptance-tests.yml (redirect uri: http://localhost.test:8080/auth/realms/test/broker/franceconnect-particulier/endpoint)

micedre commented 2 years ago

I'll ask, but I don't think it will be accepted. That said, generating a certificate would be hard?

mboisnard commented 2 years ago

It can be painful but it's possible ^^ I have a question about the JWE workflow: How does FC know the rsa public key used for encryption? Is it manually added on FC platform? Is Keycloak Jwks endpoint called by FC?