From a65a698d8228b9abada8d123ca8753e62b8325ae Mon Sep 17 00:00:00 2001 From: Scott Frederick Date: Thu, 7 Oct 2021 15:56:32 -0500 Subject: [PATCH] Add CredHub server configuration and update integration tests --- credhub-server/README.adoc | 21 +++++++++++++++ credhub-server/config/uaa.template.yml | 26 +++++++++++++++++++ credhub-server/docker-compose.yml | 22 ++++++++++++++++ credhub-server/server-ca-cert.pem | 19 ++++++++++++++ credhub-server/setup-uaa.sh | 16 ++++++++++++ .../integration/CredHubIntegrationTests.java | 23 ++++++++++++++-- .../src/test/resources/application-test.yml | 12 +++++---- .../ReactiveCredHubIntegrationTests.java | 26 ++++++++++++++----- .../ReactivePermissionIntegrationTests.java | 4 +-- .../src/test/resources/application-test.yml | 12 +++++---- 10 files changed, 161 insertions(+), 20 deletions(-) create mode 100644 credhub-server/README.adoc create mode 100644 credhub-server/config/uaa.template.yml create mode 100644 credhub-server/docker-compose.yml create mode 100644 credhub-server/server-ca-cert.pem create mode 100755 credhub-server/setup-uaa.sh diff --git a/credhub-server/README.adoc b/credhub-server/README.adoc new file mode 100644 index 0000000..a5ec82b --- /dev/null +++ b/credhub-server/README.adoc @@ -0,0 +1,21 @@ += CredHub server + +This directory contains artifacts that can be used to start UAA and CredHub servers that can be used to run tests against. +It is derived https://github.com/orange-cloudfoundry/credhub-docker and https://github.com/ampersand8/credhub-docker. + +Before running the servers for the first time, UAA needs to be configured with jwt signing keys. +To generate the configuration, ensure the `openssl` and https://carvel.dev/ytt/[`ytt`] tools are installed, the run the setup script: + +[source,bash] +---- +$ ./setup-uaa.sh +---- + +From the root of this directory, start the servers using Docker Compose: + +[source,bash] +---- +$ docker-compose up +---- + +After both servers have started successfully, UAA will be available at `http://localhost:8080/uaa` and CredHub will be available at `https://localhost:9000`. \ No newline at end of file diff --git a/credhub-server/config/uaa.template.yml b/credhub-server/config/uaa.template.yml new file mode 100644 index 0000000..1ec16d2 --- /dev/null +++ b/credhub-server/config/uaa.template.yml @@ -0,0 +1,26 @@ +#@ load("@ytt:data", "data") + +scim: + users: + - credhub|password|credhub|Credhub|User|credhub.read,credhub.write +oauth: + clients: + credhub_cli: + override: true + authorized-grant-types: password,refresh_token + scope: credhub.read,credhub.write + authorities: uaa.resource + access-token-validity: 86400 + refresh-token-validity: 172800 + secret: "" + credhub_client: + override: true + authorized-grant-types: client_credentials + secret: secret + scope: uaa.none + authorities: credhub.read,credhub.write + access-token-validity: 86400 +jwt: + token: + signing-key: #@ data.read('privkey.pem') + verification-key: #@ data.read('pubkey.pem') diff --git a/credhub-server/docker-compose.yml b/credhub-server/docker-compose.yml new file mode 100644 index 0000000..51ba89b --- /dev/null +++ b/credhub-server/docker-compose.yml @@ -0,0 +1,22 @@ +version: '2' + +services: + uaa: + image: pcfseceng/uaa + volumes: + - ./uaa.yml:/uaa/uaa.yml + ports: + - 8080:8080 + restart: always + + credhub: + image: ampersand8/credhub + ports: + - "9000:9000" + links: + - uaa:uaa + depends_on: + - uaa + environment: + UAA_URL: http://localhost:8080/uaa + UAA_INTERNAL_URL: http://uaa:8080/uaa \ No newline at end of file diff --git a/credhub-server/server-ca-cert.pem b/credhub-server/server-ca-cert.pem new file mode 100644 index 0000000..e83f86b --- /dev/null +++ b/credhub-server/server-ca-cert.pem @@ -0,0 +1,19 @@ +-----BEGIN CERTIFICATE----- +MIIDEDCCAfigAwIBAgIJANeDDfBkAyJ2MA0GCSqGSIb3DQEBCwUAMBwxGjAYBgNV +BAMMEWNyZWRodWJfc2VydmVyX2NhMCAXDTE4MDgyMjA3MDEyMFoYDzIxMTgwNzI5 +MDcwMTIwWjAcMRowGAYDVQQDDBFjcmVkaHViX3NlcnZlcl9jYTCCASIwDQYJKoZI +hvcNAQEBBQADggEPADCCAQoCggEBAMoi1p8EvrFNDJCVuZHH8zOVw/SBUrfsiqEe +HlxdemVDT0hr2xysmWJO16F9dUIehGBD/r8xyVz+7fSd5OC/ZeV7AS5lgCds6g27 +CJH0KxejtpIIWi89HBn/1OJyjowF0wHI1EwDJd4EE0aTE2AHfZLKbE//F88qbubV +ENHUXBqS9rxlr0ldUb2zwztsfQ2yfnb/7Joq6hs2VCjD+qeV98jJSIuvMuMI3rGO +U+tyOg0B6zZvo2iH0/OazayPnLyJw41BRIyhXMIt8mk8TtphnNHRuSxkvLhxWS3Z +ARerKGjf5E80fffBsWi/4qN6bnFR8aNZutXpYuLtaiK6i+S4Bu0CAwEAAaNTMFEw +HQYDVR0OBBYEFBTrhXS4ogDO/1u0MjhAcRT3Nx85MB8GA1UdIwQYMBaAFBTrhXS4 +ogDO/1u0MjhAcRT3Nx85MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQAD +ggEBAGxi/TBLJYAlLySo6vic9y4WcmHU+1bHZqGq0tca69XFnHD1H4z5+tVbbwdV +f3B1lFEyYYxxEIsb8YLyey4wWL6S9/aFCOraUMS3TkN0jDF9T8gXpqD6IBSX0Ca3 +/V8qXar5vCO91T7qJWou5WcXoPzfYve2i8LV8c9xMBdF9o1hHNKNqCCvbshpOV35 +qb3r/s+CL5elKUwWUc8/7N2tFuuSk9ETi8ApqnNPJA4OeqpDry9S+7JM/xEvIktc +utmLo8kRMd9hXZa06XIiLI23gOo08KsE98G9P79RdhpeZweAhbZoghRxj/YVmmEI +qe3dqmF87rObz/Vht6J+pH9ht30= +-----END CERTIFICATE----- \ No newline at end of file diff --git a/credhub-server/setup-uaa.sh b/credhub-server/setup-uaa.sh new file mode 100755 index 0000000..1b76d71 --- /dev/null +++ b/credhub-server/setup-uaa.sh @@ -0,0 +1,16 @@ +#!/bin/bash + +if ! command -v openssl >/dev/null; then + echo "openssl is required to generate signing keys" + exit 1 +fi + +if ! command -v ytt >/dev/null; then + echo "ytt is required to create UAA configuration YAML" + exit 1 +fi + +openssl genrsa -out config/privkey.pem 2048 +openssl rsa -pubout -in config/privkey.pem -out config/pubkey.pem + +ytt -f config > uaa.yml \ No newline at end of file diff --git a/spring-credhub-integration-tests/src/test/java/org/springframework/credhub/integration/CredHubIntegrationTests.java b/spring-credhub-integration-tests/src/test/java/org/springframework/credhub/integration/CredHubIntegrationTests.java index 447c094..9325a0d 100644 --- a/spring-credhub-integration-tests/src/test/java/org/springframework/credhub/integration/CredHubIntegrationTests.java +++ b/spring-credhub-integration-tests/src/test/java/org/springframework/credhub/integration/CredHubIntegrationTests.java @@ -16,30 +16,49 @@ package org.springframework.credhub.integration; +import org.junit.Before; import org.junit.runner.RunWith; import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.beans.factory.annotation.Value; import org.springframework.boot.test.context.SpringBootTest; import org.springframework.credhub.core.CredHubException; import org.springframework.credhub.core.CredHubOperations; import org.springframework.credhub.support.CredentialName; +import org.springframework.credhub.support.info.VersionInfo; import org.springframework.test.context.ActiveProfiles; import org.springframework.test.context.junit4.SpringRunner; +import org.springframework.util.StringUtils; @RunWith(SpringRunner.class) @SpringBootTest(classes = { TestApplication.class }) @ActiveProfiles("test") public abstract class CredHubIntegrationTests { + @Value("${test-server-version:}") + private String serverVersion; + + private VersionInfo versionInfo; + @Autowired protected CredHubOperations operations; + @Before + public void setupVersionInfo() { + if (StringUtils.hasText(this.serverVersion)) { + this.versionInfo = new VersionInfo(this.serverVersion); + } + else { + this.versionInfo = this.operations.info().version(); + } + } + boolean serverApiIsV1() { - return this.operations.info().version().isVersion1(); + return this.versionInfo.isVersion1(); } boolean serverApiIsV2() { - return this.operations.info().version().isVersion2(); + return this.versionInfo.isVersion2(); } void deleteCredentialIfExists(CredentialName credentialName) { diff --git a/spring-credhub-integration-tests/src/test/resources/application-test.yml b/spring-credhub-integration-tests/src/test/resources/application-test.yml index 5443050..bdff82c 100644 --- a/spring-credhub-integration-tests/src/test/resources/application-test.yml +++ b/spring-credhub-integration-tests/src/test/resources/application-test.yml @@ -1,8 +1,8 @@ spring: credhub: - url: ${CREDHUB_SERVER} + url: ${CREDHUB_SERVER:https://localhost:9000} ca-cert-files: - - ${CREDHUB_CA_CERT} + - ${CREDHUB_CA_CERT:../credhub-server/server-ca-cert.pem} oauth2: registration-id: credhub-test security: @@ -11,12 +11,14 @@ spring: registration: credhub-test: provider: uaa - client-id: ${CREDHUB_CLIENT} - client-secret: ${CREDHUB_SECRET} + client-id: ${CREDHUB_CLIENT:credhub_client} + client-secret: ${CREDHUB_SECRET:secret} authorization-grant-type: client_credentials provider: uaa: - token-uri: ${UAA_SERVER}/oauth/token + token-uri: ${UAA_SERVER:http://localhost:8080/uaa}/oauth/token + +test-server-version: "2.0.0" debug: true logging.level.org.springframework.web: DEBUG diff --git a/spring-credhub-reactive-integration-tests/src/test/java/org/springframework/credhub/integration/ReactiveCredHubIntegrationTests.java b/spring-credhub-reactive-integration-tests/src/test/java/org/springframework/credhub/integration/ReactiveCredHubIntegrationTests.java index 8a81e40..4a55963 100644 --- a/spring-credhub-reactive-integration-tests/src/test/java/org/springframework/credhub/integration/ReactiveCredHubIntegrationTests.java +++ b/spring-credhub-reactive-integration-tests/src/test/java/org/springframework/credhub/integration/ReactiveCredHubIntegrationTests.java @@ -16,35 +16,49 @@ package org.springframework.credhub.integration; +import org.junit.Before; import org.junit.runner.RunWith; import reactor.core.publisher.Mono; import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.beans.factory.annotation.Value; import org.springframework.boot.test.context.SpringBootTest; import org.springframework.credhub.core.ReactiveCredHubOperations; import org.springframework.credhub.support.CredentialName; import org.springframework.credhub.support.info.VersionInfo; import org.springframework.test.context.ActiveProfiles; import org.springframework.test.context.junit4.SpringRunner; +import org.springframework.util.StringUtils; @RunWith(SpringRunner.class) @SpringBootTest(classes = { TestApplication.class }) @ActiveProfiles("test") public abstract class ReactiveCredHubIntegrationTests { + @Value("${test-server-version:}") + private String serverVersion; + + private VersionInfo versionInfo; + @Autowired protected ReactiveCredHubOperations operations; + @Before + public void setupVersionInfo() { + if (StringUtils.hasText(this.serverVersion)) { + this.versionInfo = new VersionInfo(this.serverVersion); + } + else { + this.versionInfo = this.operations.info().version().single().block(); + } + } + boolean serverApiIsV1() { - return getVersion().isVersion1(); + return this.versionInfo.isVersion1(); } boolean serverApiIsV2() { - return getVersion().isVersion2(); - } - - private VersionInfo getVersion() { - return this.operations.info().version().single().block(); + return this.versionInfo.isVersion2(); } void deleteCredentialIfExists(CredentialName credentialName) { diff --git a/spring-credhub-reactive-integration-tests/src/test/java/org/springframework/credhub/integration/ReactivePermissionIntegrationTests.java b/spring-credhub-reactive-integration-tests/src/test/java/org/springframework/credhub/integration/ReactivePermissionIntegrationTests.java index 64a87e9..4ba7c8c 100644 --- a/spring-credhub-reactive-integration-tests/src/test/java/org/springframework/credhub/integration/ReactivePermissionIntegrationTests.java +++ b/spring-credhub-reactive-integration-tests/src/test/java/org/springframework/credhub/integration/ReactivePermissionIntegrationTests.java @@ -121,8 +121,8 @@ public class ReactivePermissionIntegrationTests extends ReactiveCredHubIntegrati StepVerifier.create(this.permissions.getPermissions(CREDENTIAL_NAME)) .assertNext((response) -> assertThat(response).isEqualTo(appPermission)) - .assertNext((response) -> assertThat(response).isEqualTo(userPermission)) - .assertNext((response) -> assertThat(response).isEqualTo(clientPermission)).verifyComplete(); + .assertNext((response) -> assertThat(response).isEqualTo(clientPermission)) + .assertNext((response) -> assertThat(response).isEqualTo(userPermission)).verifyComplete(); deletePermissionsIfExist(); diff --git a/spring-credhub-reactive-integration-tests/src/test/resources/application-test.yml b/spring-credhub-reactive-integration-tests/src/test/resources/application-test.yml index 5443050..bdff82c 100644 --- a/spring-credhub-reactive-integration-tests/src/test/resources/application-test.yml +++ b/spring-credhub-reactive-integration-tests/src/test/resources/application-test.yml @@ -1,8 +1,8 @@ spring: credhub: - url: ${CREDHUB_SERVER} + url: ${CREDHUB_SERVER:https://localhost:9000} ca-cert-files: - - ${CREDHUB_CA_CERT} + - ${CREDHUB_CA_CERT:../credhub-server/server-ca-cert.pem} oauth2: registration-id: credhub-test security: @@ -11,12 +11,14 @@ spring: registration: credhub-test: provider: uaa - client-id: ${CREDHUB_CLIENT} - client-secret: ${CREDHUB_SECRET} + client-id: ${CREDHUB_CLIENT:credhub_client} + client-secret: ${CREDHUB_SECRET:secret} authorization-grant-type: client_credentials provider: uaa: - token-uri: ${UAA_SERVER}/oauth/token + token-uri: ${UAA_SERVER:http://localhost:8080/uaa}/oauth/token + +test-server-version: "2.0.0" debug: true logging.level.org.springframework.web: DEBUG