Skip to content

Commit 06ca028

Browse files
dutowdutow
committed
PG-1967: Basic keycloak test setup on CI
This commit adds a very basic test using keycloak + rpec. * Keycloak is ran using docker, with a previously generated configuration which just gets imported * The test is written in rspec, for easy extensibility (different providers, different testcases) * For now it's just a simple smoke test to verify that we can log in with the validator One particularly ugly part of this is that we install the seflf signed certificates systemwide, but the only other option is using `OAUTH_DEBUG=unsafe`, which changes other behavior and results in tons of debug output. Trusting this certificate by the system seems like a more-realstic approach.
1 parent 9f972e1 commit 06ca028

File tree

16 files changed

+2784
-9
lines changed

16 files changed

+2784
-9
lines changed

‎.github/workflows/pgdg-build.yml‎

Lines changed: 93 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -31,13 +31,12 @@ jobs:
3131
3232
- name: Install PG Distribution Postgresql 18
3333
run: |
34-
sudo sh -c 'echo "deb http://apt.postgresql.org/pub/repos/apt \
35-
$(lsb_release -cs)-pgdg main 18" > /etc/apt/sources.list.d/pgdg.list'
36-
sudo wget --quiet -O - \
37-
https://www.postgresql.org/media/keys/ACCC4CF8.asc |
38-
sudo apt-key add -
39-
sudo apt update
40-
sudo apt -y install postgresql-18 postgresql-server-dev-18
34+
echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main 18" | \
35+
sudo tee /etc/apt/sources.list.d/pgdg.list
36+
wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | \
37+
gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/postgresql.gpg > /dev/null
38+
sudo apt-get update
39+
sudo apt-get install -y postgresql-18 postgresql-server-dev-18
4140
4241
- name: Checkout pg_oidc_validator extension
4342
uses: actions/checkout@v4
@@ -85,9 +84,95 @@ jobs:
8584
run: |
8685
cd pg-oidc-validator-pgdg18 && sudo tar -czvf ../pg-oidc-validator-pgdg18.tar.gz .
8786
87+
- name: Upload tgz artifact
88+
uses: actions/upload-artifact@v4
89+
with:
90+
name: pg-oidc-validator-tgz
91+
path: pg-oidc-validator-pgdg18.tar.gz
92+
93+
test:
94+
name: Test
95+
runs-on: ubuntu-latest
96+
needs: [pgxs-build]
97+
98+
steps:
99+
- name: Checkout code
100+
uses: actions/checkout@v4
101+
102+
- name: Download built package
103+
uses: actions/download-artifact@v4
104+
with:
105+
name: pg-oidc-validator-deb
106+
107+
- name: Stop default PostgreSQL
108+
run: |
109+
sudo systemctl stop postgresql || true
110+
sudo systemctl disable postgresql || true
111+
112+
- name: Install PostgreSQL 18
113+
run: |
114+
echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main 18" | \
115+
sudo tee /etc/apt/sources.list.d/pgdg.list
116+
wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | \
117+
gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/postgresql.gpg > /dev/null
118+
sudo apt-get update
119+
sudo apt-get install -y postgresql-18 libpq-oauth
120+
121+
- name: Install pg_oidc_validator package
122+
run: |
123+
sudo dpkg -i pg-oidc-validator-pgdg18.deb
124+
125+
- name: Install test dependencies
126+
run: |
127+
sudo apt-get update
128+
sudo apt-get install -y ruby-full ruby-bundler chromium-browser chromium-chromedriver curl net-tools
129+
130+
- name: Set up Ruby gems
131+
run: |
132+
cd test
133+
bundle config set --local path 'vendor/bundle'
134+
bundle install
135+
136+
- name: Install SSL certificate for psql
137+
run: |
138+
sudo cp test/keys/crt.pem /usr/local/share/ca-certificates/keycloak-test.crt
139+
sudo update-ca-certificates
140+
141+
- name: Run tests
142+
run: |
143+
cd test
144+
echo "PostgreSQL version:"
145+
/usr/lib/postgresql/18/bin/postgres --version
146+
echo "Port 5432 status:"
147+
sudo netstat -tulpn | grep 5432 || echo "Port 5432 not in use"
148+
echo "Chromium version:"
149+
chromium-browser --version || echo "Chromium not found"
150+
echo "ChromeDriver version:"
151+
chromedriver --version || echo "ChromeDriver not found"
152+
echo "Running tests..."
153+
PGBIN=/usr/lib/postgresql/18/bin bundle exec rspec --format documentation
154+
155+
- name: Upload test logs on failure
156+
if: failure()
157+
uses: actions/upload-artifact@v4
158+
with:
159+
name: test-logs
160+
path: |
161+
test/postgres.log
162+
test/psql_output.log
163+
test/selenium_output.log
164+
test/pgdata/log/*
165+
/var/log/postgresql/*
166+
if-no-files-found: ignore
167+
168+
- name: Download tgz artifact
169+
if: "github.repository == 'Percona-Lab/pg_oidc_validator' && github.ref_name == 'main' && (github.event_name == 'push' || github.event_name == 'schedule')"
170+
uses: actions/download-artifact@v4
171+
with:
172+
name: pg-oidc-validator-tgz
173+
88174
- name: Publish release
89175
uses: ncipollo/release-action@v1
90-
# Only try and deploy on merged code
91176
if: "github.repository == 'Percona-Lab/pg_oidc_validator' && github.ref_name == 'main' && (github.event_name == 'push' || github.event_name == 'schedule')"
92177
with:
93178
artifacts: "pg-oidc-validator-pgdg18.tar.gz,pg-oidc-validator-pgdg18.deb"

‎README.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ pg_ctl -D <datadir> restart
3434

3535
### pg_oidc_validator.authn_field
3636

37-
This GUC variable controls which field of the provided JWT token is used for identity mapping.
37+
This GUC variable controls which field of the provided JWT token is used for identity mapping.
3838
By default this is the `sub` claim, as most providers allow the configuration of this claim to provide different user fields.
3939

4040
In some cases however the `sub` claim is fixed to a randomly generated, application specific identifier which is non known before a user first connects to the application.
@@ -84,3 +84,7 @@ Google has some quirks which are currently not supported by the core PostgreSQL
8484

8585
### Other providers
8686
Hopefully the information above will give you everything you need to configure _your_ OIDC provider correctly. If you do, [please let us know](https://forums.percona.com/c/postgresql/) how it went!
87+
88+
## Testing
89+
90+
The validator has a basic test suite, documented under [test/README.md](test/README.md).

‎test/.gitignore‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
/pgdata/
2+
/postgres.log
3+
/psql_output.log
4+
/selenium_output.log
5+
/vendor/bundle/

‎test/Gemfile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
source 'https://rubygems.org'
2+
3+
gem 'rspec', '~> 3.12'
4+
gem 'selenium-webdriver', '~> 4.0'

‎test/Gemfile.lock‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
GEM
2+
remote: https://rubygems.org/
3+
specs:
4+
base64 (0.3.0)
5+
diff-lcs (1.6.2)
6+
logger (1.7.0)
7+
rexml (3.4.4)
8+
rspec (3.13.2)
9+
rspec-core (~> 3.13.0)
10+
rspec-expectations (~> 3.13.0)
11+
rspec-mocks (~> 3.13.0)
12+
rspec-core (3.13.6)
13+
rspec-support (~> 3.13.0)
14+
rspec-expectations (3.13.5)
15+
diff-lcs (>= 1.2.0, < 2.0)
16+
rspec-support (~> 3.13.0)
17+
rspec-mocks (3.13.7)
18+
diff-lcs (>= 1.2.0, < 2.0)
19+
rspec-support (~> 3.13.0)
20+
rspec-support (3.13.6)
21+
rubyzip (3.2.2)
22+
selenium-webdriver (4.38.0)
23+
base64 (~> 0.2)
24+
logger (~> 1.4)
25+
rexml (~> 3.2, >= 3.2.5)
26+
rubyzip (>= 1.2.2, < 4.0)
27+
websocket (~> 1.0)
28+
websocket (1.2.11)
29+
30+
PLATFORMS
31+
ruby
32+
x86_64-linux
33+
34+
DEPENDENCIES
35+
rspec (~> 3.12)
36+
selenium-webdriver (~> 4.0)
37+
38+
BUNDLED WITH
39+
2.6.9

‎test/README.md‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# OAuth Device Flow Test
2+
3+
End-to-end test for pg_oidc_validator using Keycloak.
4+
5+
## Prerequisites
6+
7+
- PostgreSQL 18 with pg_oidc_validator installed
8+
- Docker
9+
- Ruby with bundler
10+
- Chrome/Chromium with chromedriver
11+
12+
## Setup
13+
14+
```bash
15+
bundle install
16+
17+
# Trust the test SSL certificate (required for psql OAuth)
18+
sudo cp keys/crt.pem /usr/local/share/ca-certificates/keycloak-test.crt
19+
sudo update-ca-certificates
20+
```
21+
22+
## Usage
23+
24+
```bash
25+
# Run all tests
26+
PGBIN=/path/to/postgres/bin bundle exec rspec
27+
28+
# Run specific test or with options
29+
PGBIN=/path/to/postgres/bin bundle exec rspec spec/oauth_device_flow_spec.rb
30+
bundle exec rspec --format documentation
31+
```
32+
33+
## What it does
34+
35+
This is currently only a basic successful login test.
36+
37+
1. Sets up fresh PostgreSQL cluster with OAuth configuration
38+
2. Starts Keycloak with pre-configured realm
39+
3. Initiates psql OAuth device flow connection
40+
4. Automatically completes authentication using Selenium
41+
5. Verifies connection works
42+
43+
Auto-cleanup on exit.

0 commit comments

Comments
 (0)