From 3b2e63e2b56ac02d44e41b8d507a9ff05b037fca Mon Sep 17 00:00:00 2001 From: Jonathan Perret Date: Wed, 17 Apr 2024 16:10:12 +0200 Subject: [PATCH] =?UTF-8?q?=E2=9C=85(test)=20setup=20end-to-end=20manual?= =?UTF-8?q?=20test?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This sets up a test OIDC client, that will start an authentication flow to the RENATER test federation through our SATOSA instance. --- Makefile | 22 +++++++++-- docker-compose.yml | 31 ++++++++++++++- docker/files/etc/nginx/conf.d/default.conf | 46 +++++++++++++++++++--- 3 files changed, 88 insertions(+), 11 deletions(-) diff --git a/Makefile b/Makefile index 4aee6c5..9b282a8 100644 --- a/Makefile +++ b/Makefile @@ -46,6 +46,14 @@ default: help # -- Project +create-dev-certs: ## Create self-signed HTTPS certificates for development +create-dev-certs: + rm -rf env.d/development/certs + mkdir -p env.d/development/certs + cp "$$(mkcert --CAROOT)/rootCA.pem" env.d/development/certs/mkcert-root-ca.pem + mkcert -key-file env.d/development/certs/key.pem -cert-file env.d/development/certs/cert.pem *.traefik.me +.PHONY: create-dev-certs + create-env-files: ## Copy the dist env files to env files create-env-files: \ env.d/development/common \ @@ -54,6 +62,7 @@ create-env-files: \ bootstrap: ## Prepare Docker images for the project bootstrap: \ + create-dev-certs \ create-env-files \ build \ run @@ -72,9 +81,8 @@ logs: ## display app-dev logs (follow mode) @$(COMPOSE) logs -f app-dev .PHONY: logs -run: ## start the wsgi (production) and development server - @$(COMPOSE) up --force-recreate -d nginx - @$(COMPOSE) up --force-recreate -d app-dev +run: ## start the development servers + @$(COMPOSE) up --force-recreate --wait -d nginx app-dev oidc-test-client .PHONY: run status: ## an alias for "docker compose ps" @@ -119,8 +127,16 @@ test-back: ## run back-end tests bin/pytest $${args:-${1}} .PHONY: test-back +oidc-test: ## open OIDC test client in browser + @$(MAKE) down + @$(MAKE) run + python -mwebbrowser -n https://oidc-test-client.traefik.me +.PHONY: oidc-test + env.d/development/common: cp -n env.d/development/common.dist env.d/development/common + +env.d/development/satosa: cp -n env.d/development/satosa.dist env.d/development/satosa # -- Misc diff --git a/docker-compose.yml b/docker-compose.yml index 98cb47b..6cb8df8 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -8,7 +8,8 @@ services: user: ${DOCKER_USER:-1000} image: oidc2fer:development environment: - - PYLINTHOME=/app/.pylint.d + PYLINTHOME: /app/.pylint.d + BASE_URL: https://satosa.traefik.me env_file: - env.d/development/common - env.d/development/satosa @@ -27,10 +28,36 @@ services: - env.d/development/common - env.d/development/satosa + oidc-test-client: + image: ghcr.io/beryju/oidc-test-client + depends_on: + - nginx # nginx must be up to override satosa.traefik.me resolution + - app-dev + volumes: + - ./env.d/development/certs/mkcert-root-ca.pem:/usr/local/share/ca-certificates/mkcert-root-ca.crt + # - run update-ca-certificates to make mkcert certificates valid + # - add startup delay because IDP must be available on boot + entrypoint: /bin/bash -c 'update-ca-certificates && sleep 1; exec /oidc-test-client' + environment: + OIDC_ROOT_URL: https://oidc-test-client.traefik.me + OIDC_PROVIDER: https://satosa.traefik.me + OIDC_CLIENT_ID: oidc-test-client + OIDC_CLIENT_SECRET: oidc-test-secret + OIDC_DO_INTROSPECTION: false + OIDC_DO_REFRESH: false + OIDC_DO_USER_INFO: true + nginx: image: nginx:1.25 ports: + - "443:443" - "8081:8081" - - "8082:8082" volumes: - ./docker/files/etc/nginx/conf.d:/etc/nginx/conf.d:ro + - ./env.d/development/certs:/etc/nginx/certs:ro + networks: + default: + aliases: + # expose proxy internally as the public names to make internal HTTPS work + - satosa.traefik.me + - oidc-test-client.traefik.me diff --git a/docker/files/etc/nginx/conf.d/default.conf b/docker/files/etc/nginx/conf.d/default.conf index 08f88fc..9176ba3 100644 --- a/docker/files/etc/nginx/conf.d/default.conf +++ b/docker/files/etc/nginx/conf.d/default.conf @@ -1,13 +1,13 @@ resolver 127.0.0.11; +charset utf-8; server { listen 8081; server_name localhost; - charset utf-8; location / { set $backend "http://app:8000"; - proxy_pass $backend; + proxy_pass $backend; # using a variable to force late name resolution proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; @@ -15,15 +15,49 @@ server { } server { - listen 8082; - server_name localhost; - charset utf-8; + server_name satosa.traefik.me; + listen 443 ssl; + ssl_certificate /etc/nginx/certs/cert.pem; + ssl_certificate_key /etc/nginx/certs/key.pem; location / { set $backend "http://app-dev:8000"; - proxy_pass $backend; + proxy_pass $backend; # using a variable to force late name resolution + + # Set headers so downstream app will know what URL the client is using proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Host $host:443; + proxy_set_header X-Forwarded-Port 443; + proxy_set_header X-Forwarded-Server $host; + proxy_set_header X-Forwarded-Proto https; + + # SAML headers are big + proxy_buffering off; + proxy_buffer_size 128k; + proxy_buffers 4 256k; + proxy_busy_buffers_size 256k; + } +} + +server { + server_name oidc-test-client.traefik.me; + listen 443 ssl; + ssl_certificate /etc/nginx/certs/cert.pem; + ssl_certificate_key /etc/nginx/certs/key.pem; + + location / { + set $backend "http://oidc-test-client:9009"; + proxy_pass $backend; # using a variable to force late name resolution + + # Set headers so downstream app will know what URL the client is using + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Host $host:443; + proxy_set_header X-Forwarded-Port 443; + proxy_set_header X-Forwarded-Server $host; + proxy_set_header X-Forwarded-Proto https; } }