✅(test) setup end-to-end manual test

This sets up a test OIDC client, that will start an authentication flow
to the RENATER test federation through our SATOSA instance.

Makefile

@@ -46,6 +46,14 @@ default: help
 
 # -- Project
 
+create-dev-certs: ## Create self-signed HTTPS certificates for development
+create-dev-certs:
+	rm -rf env.d/development/certs
+	mkdir -p env.d/development/certs
+	cp "$$(mkcert --CAROOT)/rootCA.pem" env.d/development/certs/mkcert-root-ca.pem
+	mkcert -key-file env.d/development/certs/key.pem -cert-file env.d/development/certs/cert.pem *.traefik.me
+.PHONY: create-dev-certs
+
 create-env-files: ## Copy the dist env files to env files
 create-env-files: \
 	env.d/development/common \
@@ -54,6 +62,7 @@ create-env-files: \
 
 bootstrap: ## Prepare Docker images for the project
 bootstrap: \
+	create-dev-certs \
 	create-env-files \
 	build \
 	run
@@ -72,9 +81,8 @@ logs: ## display app-dev logs (follow mode)
 	@$(COMPOSE) logs -f app-dev
 .PHONY: logs
 
-run: ## start the wsgi (production) and development server
-	@$(COMPOSE) up --force-recreate -d nginx
-	@$(COMPOSE) up --force-recreate -d app-dev
+run: ## start the development servers
+	@$(COMPOSE) up --force-recreate --wait -d nginx app-dev oidc-test-client
 .PHONY: run
 
 status: ## an alias for "docker compose ps"
@@ -119,8 +127,16 @@ test-back: ## run back-end tests
 	bin/pytest $${args:-${1}}
 .PHONY: test-back
 
+oidc-test: ## open OIDC test client in browser
+	@$(MAKE) down
+	@$(MAKE) run
+	python -mwebbrowser -n https://oidc-test-client.traefik.me
+.PHONY: oidc-test
+
 env.d/development/common:
 	cp -n env.d/development/common.dist env.d/development/common
+
+env.d/development/satosa:
 	cp -n env.d/development/satosa.dist env.d/development/satosa
 
 # -- Misc

docker-compose.yml

@@ -8,7 +8,8 @@ services:
     user: ${DOCKER_USER:-1000}
     image: oidc2fer:development
     environment:
-      - PYLINTHOME=/app/.pylint.d
+      PYLINTHOME: /app/.pylint.d
+      BASE_URL: https://satosa.traefik.me
     env_file:
       - env.d/development/common
       - env.d/development/satosa
@@ -27,10 +28,36 @@ services:
       - env.d/development/common
       - env.d/development/satosa
 
+  oidc-test-client:
+    image: ghcr.io/beryju/oidc-test-client
+    depends_on:
+      - nginx # nginx must be up to override satosa.traefik.me resolution
+      - app-dev
+    volumes:
+      - ./env.d/development/certs/mkcert-root-ca.pem:/usr/local/share/ca-certificates/mkcert-root-ca.crt
+    # - run update-ca-certificates to make mkcert certificates valid
+    # - add startup delay because IDP must be available on boot
+    entrypoint: /bin/bash -c 'update-ca-certificates && sleep 1; exec /oidc-test-client'
+    environment:
+      OIDC_ROOT_URL: https://oidc-test-client.traefik.me
+      OIDC_PROVIDER: https://satosa.traefik.me
+      OIDC_CLIENT_ID: oidc-test-client
+      OIDC_CLIENT_SECRET: oidc-test-secret
+      OIDC_DO_INTROSPECTION: false
+      OIDC_DO_REFRESH: false
+      OIDC_DO_USER_INFO: true
+
   nginx:
     image: nginx:1.25
     ports:
+      - "443:443"
       - "8081:8081"
-      - "8082:8082"
     volumes:
       - ./docker/files/etc/nginx/conf.d:/etc/nginx/conf.d:ro
+      - ./env.d/development/certs:/etc/nginx/certs:ro
+    networks:
+      default:
+        aliases:
+          # expose proxy internally as the public names to make internal HTTPS work
+          - satosa.traefik.me
+          - oidc-test-client.traefik.me

docker/files/etc/nginx/conf.d/default.conf

@@ -1,13 +1,13 @@
 resolver 127.0.0.11;
+charset utf-8;
 
 server {
     listen 8081;
     server_name localhost;
-    charset utf-8;
 
     location / {
         set $backend "http://app:8000";
-        proxy_pass $backend;
+        proxy_pass $backend; # using a variable to force late name resolution
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -15,15 +15,49 @@ server {
 }
 
 server {
-    listen 8082;
-    server_name localhost;
-    charset utf-8;
+    server_name satosa.traefik.me;
+    listen 443 ssl;
+    ssl_certificate /etc/nginx/certs/cert.pem;
+    ssl_certificate_key /etc/nginx/certs/key.pem;
 
     location / {
         set $backend "http://app-dev:8000";
-        proxy_pass $backend;
+        proxy_pass $backend; # using a variable to force late name resolution
+
+        # Set headers so downstream app will know what URL the client is using
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Host $host:443;
+        proxy_set_header X-Forwarded-Port 443;
+        proxy_set_header X-Forwarded-Server $host;
+        proxy_set_header X-Forwarded-Proto https;
+
+        # SAML headers are big
+        proxy_buffering off;
+        proxy_buffer_size 128k;
+        proxy_buffers 4 256k;
+        proxy_busy_buffers_size 256k;
+    }
+}
+
+server {
+    server_name oidc-test-client.traefik.me;
+    listen 443 ssl;
+    ssl_certificate /etc/nginx/certs/cert.pem;
+    ssl_certificate_key /etc/nginx/certs/key.pem;
+
+    location / {
+        set $backend "http://oidc-test-client:9009";
+        proxy_pass $backend; # using a variable to force late name resolution
+
+        # Set headers so downstream app will know what URL the client is using
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Host $host:443;
+        proxy_set_header X-Forwarded-Port 443;
+        proxy_set_header X-Forwarded-Server $host;
+        proxy_set_header X-Forwarded-Proto https;
     }
 }