Add OIDC authentication to integration tests

[lubomir]

🤖 This was posted automatically by an AI agent.

Add OIDC authentication to integration tests

Deploys Dex (OIDC provider) and an in-memory LDAP server (ldaptor) alongside CTS
in the EaaS pipeline and exercises the full mod_auth_openidc → load_openidc_user
→ get_user_info → query_ldap_groups → has_role auth stack end-to-end.

Pipeline changes (.tekton/integration-test-eaas.yaml)

• New deploy-openldap task (runs in parallel with deploy-dex after
  provision-environment): creates a ConfigMap with an in-memory LDAP server
  script (using ldaptor/Twisted) defining two users (builder / readonly) and
  two groups (cts-builders / readonly-users), then deploys the server on port
  1389.
• New deploy-dex task (parallel with deploy-openldap): generates a
  self-signed CA and TLS certificate for Dex, creates a ConfigMap with a Dex
  config using the password connector and a static OAuth2 client
  (cts-integration), then deploys Dex on port 5556.
• Updated deploy-cts: runAfter now includes deploy-openldap and
  deploy-dex. The cts-config ConfigMap sets AUTH_BACKEND=oidc_or_kerberos,
  AUTH_OPENIDC_USERINFO_URI, AUTH_LDAP_SERVER (pointing to openldap:1389),
  AUTH_LDAP_GROUPS, ADMINS, and ALLOWED_BUILDERS. The httpd.conf gains
  mod_auth_openidc directives (OIDCProviderMetadataURL,
  OIDCOAuthVerifyJwksUri, OIDCClientID/Secret, OIDCRemoteUserClaim,
  OIDCCABundlePath) and a <RequireAny> block that allows unauthenticated
  GET requests while requiring a valid Bearer token for writes.
• Updated run-tests: installs requests alongside pytest, retrieves the
  Dex CA certificate, and passes AUTH_BACKEND=oidc_or_kerberos and
  DEX_URL=https://dex:5556 to the test runner so the auth tests are not skipped.

Test changes (tests/test_integration_api.py)

• AuthHTTPClient: HTTPClient subclass that injects Authorization: Bearer
  on every request.
• _get_oidc_token(): obtains a real access token from Dex via the ROPC grant;
  used by auth_http_client_builder and auth_http_client_readonly fixtures.
• write_http_client fixture: returns an AuthHTTPClient (as builder) when
  OIDC is active, or a plain HTTPClient in noauth mode. Existing workflow tests
  that perform writes are updated to use this fixture.
• Four new test functions (skipped when AUTH_BACKEND is not openidc or
  oidc_or_kerberos):
  • test_auth_unauthenticated_write_returns_401 – bare POST → 401
  • test_auth_builder_can_post_compose – builder Bearer token → 200
  • test_auth_unauthorized_user_returns_403 – readonly Bearer token → 403
  • test_auth_get_endpoints_accessible_without_token – unauthenticated GET → 200

All pre-existing tests continue to pass unchanged under AUTH_BACKEND=noauth.

[guillermodotn]

I guess this is temporary, but these dependencies would be better pre-baked into a container image.

[guillermodotn]

That said, I do not know if it is worth it for just those two dependencies.

[lubomir]

This is a good point. The LDAP setup could likely be moved to an image. In fact, the initial attempts were trying to use existing images, but neither really worked in this setup. The image for this setup would not be complicated, but there would be additional overhead about where and how to build it.

For the record, the tried images were:

• glauth - the blocker was that it doesn't support anonymous binds, so all CTS queries were denied
• osixia/openldap - doesn't work under OCP restricted-v2 SCC since the image can not run under random UID

[lubomir]

I think this could be left as a separate cleanup to not blow this PR up even more.

[guillermodotn]

Regarding how to build them, I suggest using the Containerfile in this repo, along with a PaC Konflux definition to push it to Quay.