diff --git a/modules/keycloak/Dockerfile b/modules/keycloak/Dockerfile index c30eeba..7a024a3 100644 --- a/modules/keycloak/Dockerfile +++ b/modules/keycloak/Dockerfile @@ -17,7 +17,7 @@ FROM ${BUILD_BASE} AS build # resolved away. WORKDIR /app/modules/keycloak COPY . . -RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \ +RUN node /app/node_modules/typescript/bin/tsc client.ts oidc.ts index.ts provisioner/index.ts tools/index.ts \ --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist FROM ${RUNTIME_BASE} @@ -27,4 +27,4 @@ COPY --from=build /app/modules/keycloak/dist /app/modules/keycloak/dist # the convention novox/hq issues 060/061 settled. A container that instead ran only its # provisioner (`run`) served no tools and emitted no events; a container that named no command # ran no provisioner at all. -ENV MESH_TOOL_MODULES=/app/modules/keycloak/dist/index.js,/app/modules/keycloak/dist/tools/index.js +ENV MESH_TOOL_MODULES=/app/modules/keycloak/dist/index.js,/app/modules/keycloak/dist/tools/index.js,/app/modules/keycloak/dist/provisioner/index.js diff --git a/modules/keycloak/client.ts b/modules/keycloak/client.ts index c5bedda..07a5974 100644 --- a/modules/keycloak/client.ts +++ b/modules/keycloak/client.ts @@ -12,6 +12,45 @@ function meshConfig(file?: string): Record { catch { return {}; } } +/** A secret file's value, trailing newline trimmed; undefined when unset or unreadable. */ +function secretFile(file?: string): string | undefined { + if (!file) return undefined; + try { return readFileSync(file, "utf8").replace(/\n$/, "") || undefined; } + catch { return undefined; } +} + +/** A client as the admin API represents it — only the fields this module reads or writes are typed; + * the rest travel through untouched, so an update never drops what somebody else set. */ +export interface ClientRepresentation { + id?: string; + clientId: string; + name?: string; + enabled?: boolean; + protocol?: string; + publicClient?: boolean; + clientAuthenticatorType?: string; + secret?: string; + rootUrl?: string; + baseUrl?: string; + redirectUris?: string[]; + webOrigins?: string[]; + standardFlowEnabled?: boolean; + implicitFlowEnabled?: boolean; + directAccessGrantsEnabled?: boolean; + serviceAccountsEnabled?: boolean; + attributes?: Record; + protocolMappers?: ProtocolMapperRepresentation[]; + [other: string]: unknown; +} + +export interface ProtocolMapperRepresentation { + id?: string; + name: string; + protocol: string; + protocolMapper: string; + config: Record; +} + export class KeycloakClient { readonly baseUrl: string; readonly defaultRealm: string; @@ -40,8 +79,13 @@ export class KeycloakClient { const cfg = meshConfig(env.MESH_KEYCLOAK_CONFIG_FILE); const url = cfg.url ?? env.MESH_KEYCLOAK_URL ?? `http://127.0.0.1:${env.KEYCLOAK_PORT ?? "8080"}`; const adminUser = cfg.user ?? env.MESH_KEYCLOAK_ADMIN ?? env.KEYCLOAK_ADMIN ?? "admin"; - const adminPass = cfg.password ?? env.MESH_KEYCLOAK_PASSWORD ?? env.KEYCLOAK_ADMIN_PASSWORD; - if (!adminPass) throw new Error("no Keycloak admin password — set MESH_KEYCLOAK_PASSWORD"); + // The admin password reaches the runtime as a file (novox/hq ADR 0086): the module's own `admin` + // secret, mounted read-only. The environment forms stay for a co-located server that has them. + const adminPass = cfg.password ?? secretFile(env.MESH_KEYCLOAK_PASSWORD_FILE) + ?? env.MESH_KEYCLOAK_PASSWORD ?? env.KEYCLOAK_ADMIN_PASSWORD; + if (!adminPass) { + throw new Error("no Keycloak admin password — set MESH_KEYCLOAK_PASSWORD_FILE (or MESH_KEYCLOAK_PASSWORD)"); + } const realm = cfg.realm ?? env.MESH_KEYCLOAK_REALM ?? "master"; return new KeycloakClient(url, adminUser, adminPass, realm); } @@ -159,6 +203,50 @@ export class KeycloakClient { return client.id as string; } + /** The one client with exactly this clientId, or undefined. The admin API's `clientId` filter is an + * exact match unless `search=true` is asked for. */ + async findClient(realm: string, clientId: string): Promise { + const found = await this.request( + `/${realm}/clients?clientId=${encodeURIComponent(clientId)}`); + return found.find((c) => c.clientId === clientId); + } + + async createClientFrom(realm: string, rep: ClientRepresentation): Promise { + await this.request(`/${realm}/clients`, { method: "POST", body: JSON.stringify(rep) }); + } + + /** Replace a client's representation, addressed by its internal id. */ + async updateClient(realm: string, id: string, rep: ClientRepresentation): Promise { + await this.request(`/${realm}/clients/${id}`, { method: "PUT", body: JSON.stringify(rep) }); + } + + async deleteClientById(realm: string, id: string): Promise { + await this.request(`/${realm}/clients/${id}`, { method: "DELETE" }); + } + + async clientSecretById(realm: string, id: string): Promise { + const result = await this.request<{ value?: string }>(`/${realm}/clients/${id}/client-secret`); + return result.value; + } + + async listClientMappers(realm: string, id: string): Promise { + return this.request(`/${realm}/clients/${id}/protocol-mappers/models`); + } + + async addClientMapper(realm: string, id: string, mapper: ProtocolMapperRepresentation): Promise { + await this.request(`/${realm}/clients/${id}/protocol-mappers/models`, { + method: "POST", + body: JSON.stringify(mapper), + }); + } + + async updateClientMapper(realm: string, id: string, mapper: ProtocolMapperRepresentation): Promise { + await this.request(`/${realm}/clients/${id}/protocol-mappers/models/${mapper.id}`, { + method: "PUT", + body: JSON.stringify(mapper), + }); + } + async deleteClient(realm: string, clientId: string): Promise { await this.request(`/${realm}/clients/${await this.resolveClientId(realm, clientId)}`, { method: "DELETE" }); } diff --git a/modules/keycloak/module.json b/modules/keycloak/module.json index bfef938..d9fd2fc 100644 --- a/modules/keycloak/module.json +++ b/modules/keycloak/module.json @@ -1,6 +1,12 @@ { "module": "keycloak", "version": "1", + "provides": [ + { + "name": "oidc-client", + "scope": "mesh" + } + ], "requires": [ "postgres-database", "route" @@ -41,6 +47,20 @@ "why": "anything the mesh runs that authenticates a person" } ], + "serves": { + "oidc-client": { + "issuer": "https://keycloak.novox.be/realms/master", + "authorization-path": "/protocol/openid-connect/auth", + "token-path": "/protocol/openid-connect/token", + "userinfo-path": "/protocol/openid-connect/userinfo" + } + }, + "receives": { + "oidc-client": "/var/lib/keycloak/grants/mesh.json" + }, + "grants": { + "oidc-client": "/var/lib/keycloak/grants" + }, "own-secrets": { "admin": "/var/lib/keycloak/admin.secret", "broker": "/var/lib/mesh/keycloak/broker" @@ -58,6 +78,12 @@ "path": "/var/lib/keycloak", "mode": "0700" }, + { + "id": "grants", + "type": "directory", + "path": "/var/lib/keycloak/grants", + "mode": "0700" + }, { "id": "admin-env", "type": "file", @@ -107,7 +133,7 @@ "type": "file", "path": "/var/lib/mesh/keycloak/config.json", "mode": "0600", - "content": "{}\n", + "content": "{\n \"issuer\": \"https://keycloak.novox.be/realms/master\"\n}\n", "merge": "json" }, { @@ -117,12 +143,16 @@ "network": "host", "volumes": [ "/var/lib/mesh/keycloak/broker:/run/secrets/broker:ro", - "/var/lib/mesh/keycloak/config.json:/run/config/config.json:ro" + "/var/lib/mesh/keycloak/config.json:/run/config/config.json:ro", + "/var/lib/keycloak/admin.secret:/run/secrets/admin:ro", + "/var/lib/keycloak/grants:/var/lib/keycloak/grants:ro" ], "env": { "MESH_BROKER_FILE": "/run/secrets/broker", "MESH_KEYCLOAK_URL": "http://127.0.0.1:${port:8080}", - "MESH_KEYCLOAK_CONFIG_FILE": "/run/config/config.json" + "MESH_KEYCLOAK_CONFIG_FILE": "/run/config/config.json", + "MESH_KEYCLOAK_PASSWORD_FILE": "/run/secrets/admin", + "MESH_RECEIVES": "/var/lib/keycloak/grants/mesh.json" }, "restart-on": [ "runtime-config" diff --git a/modules/keycloak/oidc.ts b/modules/keycloak/oidc.ts new file mode 100644 index 0000000..0e89055 --- /dev/null +++ b/modules/keycloak/oidc.ts @@ -0,0 +1,185 @@ +// What the `oidc-client` provision means in Keycloak: one confidential OpenID Connect client per +// consumer, in the realm this module serves, under the name and secret the mesh gave both ends. +// The provisioner (provisioner/index.ts) is the sdk harness calling these; they are here, apart from +// it, so they can be exercised against a fake admin API without a broker or a contributions file. +// +// **The client id and the secret are the mesh's, not Keycloak's (novox/hq ADR 0048).** The mesh +// derives the consumer's identity (`as`, e.g. `mesh_ace_grafana`) and hands it to both ends — the +// consumer names it as its client id through `${bound:oidc-client:as}` — and mints the secret, which +// this sets as the client's secret. Keycloak generates neither. +// +// **Where the consumer's browser comes back to is the consumer's to say.** Its contribution carries +// `callback` (a path, e.g. `/login/generic_oauth`) and the `label`/`endpoint` of the endpoint it is +// reached on; the mesh composes that endpoint's names into `name` (public) and `internal-name` +// (private network) exactly as it does for a route (novox/hq ADR 0056, 0138), so the redirect URI +// registered here is built from the same names the proxy serves the consumer under. +// +// **Only what the mesh made is touched.** A client this module creates carries the attribute +// `mesh.provisioned=true`, and its id starts with the mesh's own prefix. A client with the same id +// that lacks the mark is somebody else's: it is refused, never adopted, never updated, never deleted. + +import type { ClientRepresentation, KeycloakClient, ProtocolMapperRepresentation } from "./client.js"; + +/** The attribute marking a client as the mesh's own work. */ +export const MARK = "mesh.provisioned"; + +/** The mapper every mesh client carries: realm roles as a flat `roles` claim in the id token, the + * access token and userinfo — what a consumer maps its own roles from (grafana's role path reads + * `roles[*]`), and what the predecessor added to its hand-made clients by hand. */ +export const ROLES_MAPPER: ProtocolMapperRepresentation = { + name: "realm roles", + protocol: "openid-connect", + protocolMapper: "oidc-usermodel-realm-role-mapper", + config: { + "claim.name": "roles", + "jsonType.label": "String", + multivalued: "true", + "id.token.claim": "true", + "access.token.claim": "true", + "userinfo.token.claim": "true", + }, +}; + +/** One consumer, as the harness hands it over. */ +export interface OidcGrant { + readonly as: string; + readonly password: string; + readonly values: Readonly>; + readonly consumer?: string; +} + +/** The realm named by an issuer URL — `https://id.example/realms/Novox` is realm `Novox`. The issuer is + * the one value an assignment sets (it is also what consumers are served), so the realm is read + * out of it rather than set a second time where the two could disagree. */ +export function realmOf(issuer: string): string { + let path: string; + try { + path = new URL(issuer).pathname; + } catch { + throw new Error(`the issuer ${JSON.stringify(issuer)} is not a URL`); + } + const m = /\/realms\/([^/]+)\/?$/.exec(path); + if (!m) throw new Error(`the issuer ${JSON.stringify(issuer)} does not end in /realms/`); + return decodeURIComponent(m[1]); +} + +/** The redirect URIs a consumer's contribution asks for: its callback under each name the mesh + * composed for its endpoint. Refused when there is nothing to register — a client that accepts no + * redirect is a client nobody can log in through, and one that accepts any is worse. */ +export function redirectsOf(values: Readonly>): { root: string; redirects: string[] } { + const callback = values.callback; + if (typeof callback !== "string" || !callback.startsWith("/")) { + throw new Error(`contributes no callback path (\`callback\`, starting with "/"): ${JSON.stringify(callback)}`); + } + const names: string[] = []; + for (const key of ["name", "internal-name"]) { + const n = values[key]; + if (typeof n === "string" && n.trim() !== "" && !names.includes(n.trim())) names.push(n.trim()); + } + if (names.length === 0) { + throw new Error("has no name the mesh composed (`name` / `internal-name`) — contribute a `label` and the `endpoint` it is reached on"); + } + return { root: `https://${names[0]}`, redirects: names.map((n) => `https://${n}${callback}`) }; +} + +/** The fields the mesh owns on a client it made. Everything else on the client is left as found. */ +function wanted(g: OidcGrant): ClientRepresentation { + const { root, redirects } = redirectsOf(g.values); + return { + clientId: g.as, + name: g.as, + description: `made by the mesh for ${g.consumer ? `a module on ${g.consumer}` : "a consumer"} — do not edit; it is reset`, + enabled: true, + protocol: "openid-connect", + publicClient: false, + clientAuthenticatorType: "client-secret", + secret: g.password, + rootUrl: root, + baseUrl: root, + redirectUris: redirects, + standardFlowEnabled: true, + implicitFlowEnabled: false, + directAccessGrantsEnabled: false, + serviceAccountsEnabled: false, + }; +} + +function sameSet(a: readonly string[] | undefined, b: readonly string[]): boolean { + const x = [...(a ?? [])].sort(); + const y = [...b].sort(); + return x.length === y.length && x.every((v, i) => v === y[i]); +} + +function marked(c: ClientRepresentation): boolean { + return c.attributes?.[MARK] === "true"; +} + +export class OidcClients { + constructor(private readonly kc: KeycloakClient, readonly realm: string) {} + + /** Create the consumer's client, or bring the mesh's existing one back to what the grant says. + * Returns whether it was newly created. Idempotent: applying the same grant twice changes nothing + * the second time beyond re-asserting it. */ + async ensure(g: OidcGrant): Promise<"created" | "updated"> { + const want = wanted(g); + const found = await this.kc.findClient(this.realm, g.as); + if (found && !marked(found)) { + throw new Error( + `realm ${this.realm} already has a client ${g.as} the mesh did not make — left alone; ` + + `delete or rename it if the mesh should own that id`); + } + if (!found) { + await this.kc.createClientFrom(this.realm, { + ...want, + attributes: { [MARK]: "true" }, + protocolMappers: [ROLES_MAPPER], + }); + return "created"; + } + // Overlay what the mesh owns on what is there, so a field Keycloak added or an operator set on a + // field the mesh does not own survives the update. + await this.kc.updateClient(this.realm, found.id!, { + ...found, + ...want, + attributes: { ...(found.attributes ?? {}), [MARK]: "true" }, + }); + await this.ensureMapper(found.id!); + return "updated"; + } + + private async ensureMapper(id: string): Promise { + const mappers = await this.kc.listClientMappers(this.realm, id); + const have = mappers.find((m) => m.name === ROLES_MAPPER.name); + if (!have) { + await this.kc.addClientMapper(this.realm, id, ROLES_MAPPER); + return; + } + const drifted = + have.protocolMapper !== ROLES_MAPPER.protocolMapper || + Object.entries(ROLES_MAPPER.config).some(([k, v]) => have.config?.[k] !== v); + if (drifted) { + await this.kc.updateClientMapper(this.realm, id, { ...ROLES_MAPPER, id: have.id }); + } + } + + /** Whether Keycloak still holds this consumer's client exactly as the grant says: present, the + * mesh's, enabled, confidential, with the mesh's secret and the redirects asked for. Reads only. */ + async holds(g: OidcGrant): Promise { + const want = wanted(g); + const found = await this.kc.findClient(this.realm, g.as); + if (!found || !marked(found) || found.enabled === false || found.publicClient) return false; + if (!sameSet(found.redirectUris, want.redirectUris!)) return false; + const mappers = await this.kc.listClientMappers(this.realm, found.id!); + if (!mappers.some((m) => m.name === ROLES_MAPPER.name)) return false; + return (await this.kc.clientSecretById(this.realm, found.id!)) === g.password; + } + + /** Withdraw a consumer's client — only one the mesh made. Returns what happened, for the log. */ + async remove(as: string): Promise<"removed" | "absent" | "not ours"> { + const found = await this.kc.findClient(this.realm, as); + if (!found) return "absent"; + if (!marked(found)) return "not ours"; + await this.kc.deleteClientById(this.realm, found.id!); + return "removed"; + } +} diff --git a/modules/keycloak/package.json b/modules/keycloak/package.json index b94ee32..9ed1725 100644 --- a/modules/keycloak/package.json +++ b/modules/keycloak/package.json @@ -1,11 +1,15 @@ { "name": "@novox/module-keycloak", "version": "0.1.0", - "description": "keycloak — identity and access. Its admin API client, tools and events live here (novox/hq ADR 0039).", + "description": "keycloak — identity and access; provides the mesh oidc-client interface. Its admin API client, provisioner, tools and events live here (novox/hq ADR 0039).", "type": "module", "private": true, + "scripts": { + "build": "tsc client.ts oidc.ts index.ts provisioner/index.ts tools/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist", + "test": "npm run build && node --test --experimental-strip-types 'test/*.test.ts'" + }, "dependencies": { - "@novox/mesh-sdk": "^0.1.0" + "@novox/mesh-sdk": "^0.1.1" }, "devDependencies": { "@types/node": "^22.0.0", diff --git a/modules/keycloak/provisioner/index.ts b/modules/keycloak/provisioner/index.ts new file mode 100644 index 0000000..4c34408 --- /dev/null +++ b/modules/keycloak/provisioner/index.ts @@ -0,0 +1,73 @@ +// keycloak's provisioner — the adapter that makes keycloak a provider of the mesh `oidc-client` +// interface. The reconcile loop, the contributions file and reading the mesh's minted secret are the +// sdk harness's; this writes only the per-service half: how Keycloak creates, checks and removes a +// consumer's client (novox/hq ADR 0039/0040/0048). What a client is, and which ones are the mesh's, +// is in ../oidc.ts. +// +// The `oidc-client` interface: a consumer logs people in through the realm this module serves, as +// the confidential client `as` with the secret the mesh minted, and is redirected back to the +// callback it contributed under the names the mesh composed for its endpoint. What it is served — +// the issuer and the endpoint paths under it — is in the manifest's `serves`, settled with the +// assignment's settings. +// +// **The realm is read out of the issuer**, the one value an assignment sets (settings reach both the +// served facts and this module's config.json): a realm set in one place and an issuer in another +// would let the consumer be told one realm while its client is made in another. + +import { runProvisioner, type Provision } from "@novox/mesh-sdk/provisioner"; +import { emit } from "@novox/mesh-sdk/events"; +import { readFileSync } from "node:fs"; +import { KeycloakClient } from "../client.js"; +import { OidcClients, realmOf } from "../oidc.js"; + +/** The issuer this assignment serves, from the settings-merged config the mesh delivers. */ +function issuer(): string { + const file = process.env.MESH_KEYCLOAK_CONFIG_FILE; + let cfg: Record = {}; + if (file) { + try { + cfg = JSON.parse(readFileSync(file, "utf8")) as Record; + } catch { + // Absent or unreadable: fall through to the environment, and refuse below if that is empty too. + } + } + const said = typeof cfg.issuer === "string" ? cfg.issuer : process.env.MESH_KEYCLOAK_ISSUER; + if (!said) throw new Error("no issuer — the module's config.json carries none and MESH_KEYCLOAK_ISSUER is unset"); + return said; +} + +const clients = new OidcClients(KeycloakClient.fromEnv(), realmOf(issuer())); + +/** Emit a lifecycle event without letting a broker hiccup fail the provisioning itself. */ +async function announce(type: string, body: Record): Promise { + try { + await emit(type, body); + } catch (err) { + console.error(`[provisioner:oidc-client] emit ${type} failed: ${err}`); + } +} + +runProvisioner("oidc-client", { + async create(p: Provision): Promise { + const done = await clients.ensure(p); + if (done === "created") { + console.log(`[provisioner:oidc-client] created client ${p.as} in realm ${clients.realm}`); + await announce("client.created", { realm: clients.realm, clientId: p.as, consumer: p.consumer ?? "" }); + } + }, + + async remove(p: { as: string }): Promise { + const done = await clients.remove(p.as); + if (done === "not ours") { + console.error(`[provisioner:oidc-client] ${p.as}: a client of that id exists that the mesh did not make — left alone`); + } else if (done === "removed") { + console.log(`[provisioner:oidc-client] removed client ${p.as} from realm ${clients.realm}`); + } + }, + + // Asked every minute by the harness: whether Keycloak still holds this consumer's client exactly as + // the mesh gave it, so a client deleted or edited behind the mesh's back is made again (hq issue 120). + async holds(p: Provision): Promise { + return clients.holds(p); + }, +}); diff --git a/modules/keycloak/test/oidc.test.ts b/modules/keycloak/test/oidc.test.ts new file mode 100644 index 0000000..736e2c2 --- /dev/null +++ b/modules/keycloak/test/oidc.test.ts @@ -0,0 +1,239 @@ +// What holds keycloak to the `oidc-client` provision (oidc.ts): one confidential client per consumer, +// under the id and secret the mesh gave, redirecting only to the consumer's own callback under the +// names the mesh composed; made once and brought back on every apply; and a client the mesh did not +// make — same id or not — never adopted, changed or deleted. +// +// Keycloak is a fake: the admin routes the module touches, answering with the status codes and the +// shapes Keycloak gives. Run against the compiled module (npm test builds first), the way the runtime +// loads it. + +import { test, after } from "node:test"; +import assert from "node:assert/strict"; +import { createServer, type IncomingMessage, type ServerResponse } from "node:http"; +import { randomUUID } from "node:crypto"; + +import { KeycloakClient } from "../dist/client.js"; +import { MARK, OidcClients, ROLES_MAPPER, realmOf, redirectsOf } from "../dist/oidc.js"; + +type Client = Record; + +/** The realm's clients, by internal id, and what the fake was asked. */ +const realm = "Novox"; +const clients = new Map(); +const calls: string[] = []; + +function body(req: IncomingMessage): Promise { + return new Promise((resolve) => { + let raw = ""; + req.on("data", (c) => (raw += c)); + req.on("end", () => resolve(raw ? JSON.parse(raw) : undefined)); + }); +} + +function send(res: ServerResponse, status: number, value?: unknown): void { + res.writeHead(status, { "Content-Type": "application/json" }); + res.end(value === undefined ? "" : JSON.stringify(value)); +} + +const server = createServer(async (req, res) => { + const url = new URL(req.url!, "http://fake"); + calls.push(`${req.method} ${url.pathname}`); + if (url.pathname === "/realms/master/protocol/openid-connect/token") { + return send(res, 200, { access_token: "t", expires_in: 300 }); + } + const base = `/admin/realms/${realm}/clients`; + if (!url.pathname.startsWith(base)) return send(res, 404, { error: "Realm not found." }); + const rest = url.pathname.slice(base.length).split("/").filter(Boolean); + if (rest.length === 0 && req.method === "GET") { + const want = url.searchParams.get("clientId"); + return send(res, 200, [...clients.values()].filter((c) => !want || c.clientId === want)); + } + if (rest.length === 0 && req.method === "POST") { + const rep = await body(req); + if ([...clients.values()].some((c) => c.clientId === rep.clientId)) { + return send(res, 409, { errorMessage: `Client ${rep.clientId} already exists` }); + } + const id = randomUUID(); + const mappers = (rep.protocolMappers ?? []).map((m: Client) => ({ ...m, id: randomUUID() })); + clients.set(id, { ...rep, id, protocolMappers: mappers }); + return send(res, 201); + } + const c = clients.get(rest[0]); + if (!c) return send(res, 404, { error: "Could not find client" }); + if (rest.length === 1 && req.method === "PUT") { + // Keycloak ignores protocolMappers on a client update: they have their own endpoints. + const rep = await body(req); + clients.set(c.id, { ...rep, id: c.id, protocolMappers: c.protocolMappers }); + return send(res, 204); + } + if (rest.length === 1 && req.method === "DELETE") { + clients.delete(c.id); + return send(res, 204); + } + if (rest[1] === "client-secret" && req.method === "GET") { + return send(res, 200, { type: "secret", value: c.secret }); + } + if (rest[1] === "protocol-mappers") { + if (req.method === "GET") return send(res, 200, c.protocolMappers ?? []); + if (req.method === "POST") { + c.protocolMappers = [...(c.protocolMappers ?? []), { ...(await body(req)), id: randomUUID() }]; + return send(res, 201); + } + if (req.method === "PUT") { + const m = await body(req); + c.protocolMappers = c.protocolMappers.map((x: Client) => (x.id === rest[4] ? m : x)); + return send(res, 204); + } + } + send(res, 405); +}); +await new Promise((r) => server.listen(0, "127.0.0.1", r)); +after(() => server.close()); +const port = (server.address() as { port: number }).port; + +const oidc = new OidcClients(new KeycloakClient(`http://127.0.0.1:${port}`, "admin", "pw"), realm); + +/** Grafana on ace, as the mesh hands it to the provisioner. */ +function grafana(secret = "s3cret", values: Record = {}) { + return { + as: "mesh_ace_grafana", + password: secret, + consumer: "ace", + values: { + label: "grafana", endpoint: "web", port: 20010, callback: "/login/generic_oauth", + name: "grafana.zurag.be", "internal-name": "grafana.ace.internal", ...values, + }, + }; +} + +function only(clientId: string): Client { + const found = [...clients.values()].filter((c) => c.clientId === clientId); + assert.equal(found.length, 1, `exactly one client ${clientId}, found ${found.length}`); + return found[0]; +} + +test("the realm is read out of the issuer, and an issuer that names none is refused", () => { + assert.equal(realmOf("https://keycloak.novox.be/realms/Novox"), "Novox"); + assert.equal(realmOf("https://keycloak.novox.be/realms/Novox/"), "Novox"); + assert.equal(realmOf("http://127.0.0.1:18500/realms/master"), "master"); + assert.throws(() => realmOf("https://keycloak.novox.be"), /realms/); + assert.throws(() => realmOf("keycloak"), /not a URL/); +}); + +test("the redirect is the consumer's callback under every name the mesh composed for it", () => { + assert.deepEqual(redirectsOf(grafana().values), { + root: "https://grafana.zurag.be", + redirects: ["https://grafana.zurag.be/login/generic_oauth", "https://grafana.ace.internal/login/generic_oauth"], + }); + // A route reaching only the private network has only the internal name, and that is enough. + assert.deepEqual(redirectsOf({ callback: "/cb", "internal-name": "x.ace.internal" }).redirects, + ["https://x.ace.internal/cb"]); + assert.throws(() => redirectsOf({ name: "grafana.zurag.be" }), /callback/); + assert.throws(() => redirectsOf({ name: "grafana.zurag.be", callback: "login" }), /callback/); + assert.throws(() => redirectsOf({ callback: "/cb" }), /label/); +}); + +test("a consumer is given one confidential client, under its id and the mesh's secret", async () => { + clients.clear(); + assert.equal(await oidc.ensure(grafana()), "created"); + const c = only("mesh_ace_grafana"); + assert.equal(c.publicClient, false); + assert.equal(c.clientAuthenticatorType, "client-secret"); + assert.equal(c.secret, "s3cret"); + assert.equal(c.enabled, true); + assert.equal(c.standardFlowEnabled, true); + assert.equal(c.directAccessGrantsEnabled, false); + assert.equal(c.implicitFlowEnabled, false); + assert.deepEqual(c.redirectUris, [ + "https://grafana.zurag.be/login/generic_oauth", "https://grafana.ace.internal/login/generic_oauth"]); + assert.equal(c.attributes[MARK], "true"); + assert.deepEqual(c.protocolMappers.map((m: Client) => m.name), [ROLES_MAPPER.name]); + assert.equal(await oidc.holds(grafana()), true); +}); + +test("applying the same grant again makes no second client", async () => { + clients.clear(); + await oidc.ensure(grafana()); + assert.equal(await oidc.ensure(grafana()), "updated"); + assert.equal(await oidc.ensure(grafana()), "updated"); + only("mesh_ace_grafana"); + assert.equal(only("mesh_ace_grafana").protocolMappers.length, 1, "the roles mapper is not added twice"); +}); + +test("a new secret or a moved name is applied in place, and what the mesh does not own survives", async () => { + clients.clear(); + await oidc.ensure(grafana()); + const id = only("mesh_ace_grafana").id; + // Something the mesh does not own, set on the client after it was made. + clients.get(id)!.consentRequired = true; + clients.get(id)!.attributes["post.logout.redirect.uris"] = "+"; + + assert.equal(await oidc.holds(grafana("rotated")), false, "a rotated secret is not held until applied"); + await oidc.ensure(grafana("rotated", { name: "dash.zurag.be" })); + const c = only("mesh_ace_grafana"); + assert.equal(c.id, id, "updated, not replaced"); + assert.equal(c.secret, "rotated"); + assert.deepEqual(c.redirectUris, [ + "https://dash.zurag.be/login/generic_oauth", "https://grafana.ace.internal/login/generic_oauth"]); + assert.equal(c.rootUrl, "https://dash.zurag.be"); + assert.equal(c.consentRequired, true); + assert.equal(c.attributes["post.logout.redirect.uris"], "+"); + assert.equal(c.attributes[MARK], "true"); + assert.equal(await oidc.holds(grafana("rotated", { name: "dash.zurag.be" })), true); +}); + +test("a client lost or edited behind the mesh's back is not held, and is made whole again", async () => { + clients.clear(); + await oidc.ensure(grafana()); + const c = only("mesh_ace_grafana"); + c.redirectUris = ["*"]; + assert.equal(await oidc.holds(grafana()), false, "a widened redirect is not what the mesh gave"); + await oidc.ensure(grafana()); + assert.equal(await oidc.holds(grafana()), true); + + only("mesh_ace_grafana").protocolMappers = []; + assert.equal(await oidc.holds(grafana()), false, "a client without its roles mapper is not held"); + await oidc.ensure(grafana()); + assert.equal(await oidc.holds(grafana()), true); + + clients.clear(); + assert.equal(await oidc.holds(grafana()), false); +}); + +test("a client of the same id the mesh did not make is refused, and left exactly as it was", async () => { + clients.clear(); + clients.set("theirs", { id: "theirs", clientId: "mesh_ace_grafana", secret: "their-secret", redirectUris: ["*"] }); + const before = JSON.stringify(clients.get("theirs")); + const writes = calls.length; + await assert.rejects(oidc.ensure(grafana()), /did not make/); + assert.equal(JSON.stringify(clients.get("theirs")), before); + assert.ok(calls.slice(writes).every((c) => c.startsWith("GET") || c.startsWith("POST /realms/master")), + `only reads were made: ${calls.slice(writes).join(", ")}`); + assert.equal(await oidc.holds(grafana()), false); + assert.equal(await oidc.remove("mesh_ace_grafana"), "not ours"); + assert.ok(clients.has("theirs"), "a client the mesh did not make is never deleted"); +}); + +test("the predecessor's hand-made client is never touched: the mesh's has its own id", async () => { + clients.clear(); + clients.set("hal", { id: "hal", clientId: "grafana", secret: "old", redirectUris: ["https://grafana.zurag.be/*"] }); + await oidc.ensure(grafana()); + assert.equal(clients.get("hal")!.secret, "old"); + only("mesh_ace_grafana"); + assert.equal(await oidc.remove("grafana"), "not ours"); + assert.ok(clients.has("hal")); +}); + +test("a withdrawn consumer's client is removed, and an absent one is not an error", async () => { + clients.clear(); + await oidc.ensure(grafana()); + assert.equal(await oidc.remove("mesh_ace_grafana"), "removed"); + assert.equal([...clients.values()].length, 0); + assert.equal(await oidc.remove("mesh_ace_grafana"), "absent"); +}); + +test("a contribution with no callback makes no client at all", async () => { + clients.clear(); + await assert.rejects(oidc.ensure({ ...grafana(), values: { name: "grafana.zurag.be" } }), /callback/); + assert.equal(clients.size, 0); +}); diff --git a/modules/keycloak/tsconfig.json b/modules/keycloak/tsconfig.json index 3677859..aed1dd0 100644 --- a/modules/keycloak/tsconfig.json +++ b/modules/keycloak/tsconfig.json @@ -8,5 +8,5 @@ "skipLibCheck": true, "noEmit": true }, - "include": ["client.ts", "index.ts", "tools/index.ts"] + "include": ["client.ts", "oidc.ts", "index.ts", "provisioner/index.ts", "tools/index.ts"] }