Skip to content

OIDC policy#740

Merged
crstrn13 merged 1 commit intoKuadrant:mainfrom
crstrn13:oidc-policy
Nov 6, 2025
Merged

OIDC policy#740
crstrn13 merged 1 commit intoKuadrant:mainfrom
crstrn13:oidc-policy

Conversation

@crstrn13
Copy link
Copy Markdown
Contributor

@crstrn13 crstrn13 commented Sep 2, 2025

Summary
Added OIDC policy extension tests for Authorino, covering different authentication flows and hostname configurations.

Test Coverage

  • Public Client (PKCE flow)
  • Service Client (M2M flow)
  • Confidential Client (Auth code flow)

Each flow tested against:

  • Gateway/Route targets
  • Wildcard/FQDN hostnames
  • Auth/Unauth scenarios

Requirements

  • Requires Authorino with extensions support (@pytest.mark.extensions)
  • Keycloak as OIDC provider

@crstrn13 crstrn13 requested a review from averevki September 2, 2025 11:28
@crstrn13 crstrn13 mentioned this pull request Sep 2, 2025
16 tasks
Copy link
Copy Markdown
Contributor

@trepel trepel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@crstrn13 Great work! The tests passed and there are only small typos there. I am just not sure about that to_dict methods so I pinged Aleks to see what he thinks about it.

Comment thread Makefile Outdated
Comment thread testsuite/kuadrant/extensions/oidc_policy.py Outdated
Comment thread testsuite/kuadrant/extensions/oidc_policy.py
Comment thread testsuite/kuadrant/extensions/oidc_policy.py Outdated
Comment thread testsuite/tests/singlecluster/extensions/oidc_policy/conftest.py Outdated
Comment thread testsuite/tests/singlecluster/extensions/oidc_policy/test_oidc_policy.py Outdated
@crstrn13 crstrn13 requested a review from trepel September 24, 2025 10:52
trepel
trepel previously approved these changes Sep 25, 2025
Copy link
Copy Markdown
Contributor

@trepel trepel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice! LGTM now.

@crstrn13 I leave merging this to you since we need to make sure that extensions are installed as part of nightlies first. Feel free to ping me for review for that work too.

Comment thread testsuite/kuadrant/extensions/oidc_policy.py Outdated
Comment thread testsuite/kuadrant/extensions/oidc_policy.py Outdated
Comment thread testsuite/kuadrant/extensions/oidc_policy.py Outdated
Comment thread testsuite/kuadrant/extensions/oidc_policy.py Outdated
Comment thread testsuite/kuadrant/extensions/oidc_policy.py Outdated
Comment thread testsuite/tests/singlecluster/extensions/oidc_policy/test_oidc_policy.py Outdated
Comment thread testsuite/tests/singlecluster/extensions/oidc_policy/test_oidc_policy.py Outdated
Comment thread testsuite/tests/singlecluster/extensions/oidc_policy/test_oidc_policy.py Outdated
Comment thread testsuite/tests/singlecluster/extensions/oidc_policy/conftest.py Outdated
Comment thread testsuite/tests/singlecluster/extensions/oidc_policy/conftest.py Outdated
Comment thread testsuite/tests/singlecluster/extensions/oidc_policy/test_oidc_policy.py Outdated
Copy link
Copy Markdown
Contributor

@averevki averevki left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"Error from server (BadRequest): error when creating \"STDIN\": OIDCPolicy in version \"v1alpha1\" cannot be handled as a OIDCPolicy: strict decoding error: unknown field \"spec.provider.clientSecret\"\n"

tbh it is very hard to understand what these test are doing now. I don't see you add any new classes/methods to delegate the setup logic from the test, you only work with functions and fixtures which can be converted and reused later if they are part of the testsuite structure.

I see you are doing a lot of asserts here now. Do you actually check for properties that kuadrant adds? Or some of the asserts check for values added from keycloak and standard protocols? I think starting with simpler oidcpolicy test will be more helpful, but I might be wrong as I didn't understand these tests completely yet lol

Comment thread Makefile
Comment thread testsuite/tests/singlecluster/extensions/oidc_policy/conftest.py Outdated
@crstrn13 crstrn13 force-pushed the oidc-policy branch 2 times, most recently from d13c7ad to f5661a4 Compare October 24, 2025 13:40
@crstrn13 crstrn13 requested a review from averevki October 30, 2025 10:29
Copy link
Copy Markdown
Contributor

@averevki averevki left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"Error from server (BadRequest): error when creating \"STDIN\": OIDCPolicy in version \"v1alpha1\" cannot be handled as a OIDCPolicy: strict decoding error: unknown field \"spec.provider.clientSecret\"\n"

Comment thread testsuite/tests/singlecluster/extensions/oidc_policy/conftest.py Outdated
Comment thread testsuite/oidc/test_client.py Outdated
Comment thread testsuite/oidc/test_client.py Outdated
Comment thread testsuite/oidc/cookie_helper.py Outdated
Comment thread testsuite/oidc/test_client.py Outdated
Comment thread testsuite/tests/singlecluster/conftest.py
Comment thread testsuite/oidc/test_client.py Outdated
Signed-off-by: Alexander Cristurean <acristur@redhat.com>
Copy link
Copy Markdown
Contributor

@averevki averevki left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@crstrn13 crstrn13 merged commit d6091a1 into Kuadrant:main Nov 6, 2025
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants