Skip to content

Add OIDC authentication flows tests for federation#3575

Merged
openshift-merge-bot[bot] merged 1 commit into
openstack-k8s-operators:mainfrom
xek:oidc-auth-tests
Jun 17, 2026
Merged

Add OIDC authentication flows tests for federation#3575
openshift-merge-bot[bot] merged 1 commit into
openstack-k8s-operators:mainfrom
xek:oidc-auth-tests

Conversation

@xek

@xek xek commented Dec 23, 2025 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown
Contributor

This adds support for testing all OIDC authentication methods:

  • v3oidcpassword (Resource Owner Password Credentials)
  • v3oidcclientcredentials (Client Credentials)
  • v3oidcaccesstoken (Access Token Reuse)
  • v3oidcauthcode (Authorization Code)

New features:

  • Templates for each OIDC auth method configuration
  • Helper script to obtain tokens from Keycloak
  • Keycloak client setup for Service Accounts and Device Auth
  • Comprehensive test suite with assertions
  • Updated README with full documentation

Note: v3oidcdeviceauthz requires Python 3.10+ and is not
available in OSP18 which ships with Python 3.9.

Jira: OSPRH-22826

@openshift-ci

openshift-ci Bot commented Dec 23, 2025

Copy link
Copy Markdown
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@xek xek force-pushed the oidc-auth-tests branch 2 times, most recently from c2c5b11 to 133a0b4 Compare December 23, 2025 15:30
@softwarefactory-project-zuul

softwarefactory-project-zuul Bot commented Dec 23, 2025

Copy link
Copy Markdown

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/6784616a5ea14ec68f0010c05d3dfdeb

✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 36m 26s
✔️ podified-multinode-edpm-deployment-crc SUCCESS in 1h 23m 55s
✔️ cifmw-crc-podified-edpm-baremetal SUCCESS in 1h 37m 52s
❌ cifmw-crc-podified-edpm-baremetal-minor-update FAILURE in 2h 22m 47s
✔️ cifmw-pod-zuul-files SUCCESS in 4m 48s
✔️ noop SUCCESS in 0s
✔️ cifmw-pod-ansible-test SUCCESS in 8m 59s
❌ cifmw-pod-pre-commit FAILURE in 8m 09s
✔️ cifmw-molecule-federation SUCCESS in 1m 42s

@xek xek force-pushed the oidc-auth-tests branch from 133a0b4 to fdd1f2d Compare January 2, 2026 12:03
@softwarefactory-project-zuul

softwarefactory-project-zuul Bot commented Jan 2, 2026

Copy link
Copy Markdown

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/888f51a660624496a38dbb9ea0ba7425

✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 35m 57s
✔️ podified-multinode-edpm-deployment-crc SUCCESS in 1h 24m 17s
✔️ cifmw-crc-podified-edpm-baremetal SUCCESS in 1h 43m 29s
✔️ cifmw-crc-podified-edpm-baremetal-minor-update SUCCESS in 2h 17m 29s
✔️ cifmw-pod-zuul-files SUCCESS in 23m 51s
✔️ noop SUCCESS in 0s
✔️ cifmw-pod-ansible-test SUCCESS in 8m 24s
❌ cifmw-pod-pre-commit FAILURE in 8m 03s
✔️ cifmw-molecule-federation SUCCESS in 1m 43s

jagee
jagee reviewed Jan 7, 2026
View reviewed changes

@jagee jagee left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Everything looks good to me, just wanted see if you though we should remove one duplicate auth test from the older code.

Comment thread roles/federation/tasks/hook_post_deploy.yml
@xek xek force-pushed the oidc-auth-tests branch 3 times, most recently from ab83014 to 63dd522 Compare January 22, 2026 12:29
@xek xek marked this pull request as ready for review January 22, 2026 12:30
@xek xek force-pushed the oidc-auth-tests branch from 63dd522 to 81ad51b Compare January 23, 2026 11:41
@xek xek force-pushed the oidc-auth-tests branch 3 times, most recently from b787b6a to 64c8c9c Compare January 23, 2026 12:34
@michburk

michburk commented Jan 23, 2026

Copy link
Copy Markdown
Contributor

Hi @xek , thanks for the patch and thanks for including test results, but please don't directly share downstream links (e.g. links to our private gitlab instance or downstream zuul) here on github. It's technically a leak, no matter how small and insignificant. Instead, include a link to a jira ticket here on github, and on that ticket, include the downstream link in a comment marked as 'Restricted to Red Hat Employee'.

Thanks!

@openstack-k8s-operators openstack-k8s-operators deleted a comment from xek Jan 23, 2026
@xek xek requested a review from jagee February 2, 2026 11:25
@xek xek force-pushed the oidc-auth-tests branch from 64c8c9c to d318861 Compare February 2, 2026 11:26
jagee
jagee previously approved these changes Feb 2, 2026
View reviewed changes

@jagee jagee left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good to me

@xek xek force-pushed the oidc-auth-tests branch from d318861 to 866cf0a Compare February 5, 2026 09:16
@xek

xek commented Feb 5, 2026

Copy link
Copy Markdown
Contributor Author

Hi team! Could someone please review this PR that adds OIDC authentication flow tests for federation?

Based on previous federation work, pinging potential reviewers:

This PR adds comprehensive testing for all OIDC auth methods:

  • v3oidcpassword
  • v3oidcclientcredentials
  • v3oidcaccesstoken
  • v3oidcauthcode

Thanks!

@openshift-ci openshift-ci Bot added the lgtm label Apr 8, 2026
@michburk michburk requested review from danpawlik and evallesp April 8, 2026 20:04
@xek xek dismissed stale reviews from michburk and jagee via b32118a April 13, 2026 15:30
@xek xek force-pushed the oidc-auth-tests branch from b32118a to eac6c88 Compare April 23, 2026 11:35
@openshift-ci openshift-ci Bot removed the lgtm label Apr 23, 2026
@softwarefactory-project-zuul

softwarefactory-project-zuul Bot commented Apr 23, 2026

Copy link
Copy Markdown

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/6e30245a753b44bfbb34472bd6341d01

✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 49m 04s
✔️ podified-multinode-edpm-deployment-crc SUCCESS in 1h 26m 03s
✔️ cifmw-crc-podified-edpm-baremetal SUCCESS in 1h 35m 32s
❌ cifmw-crc-podified-edpm-baremetal-minor-update NODE_FAILURE Node request 099-0008217237 failed in 0s
✔️ cifmw-pod-zuul-files SUCCESS in 5m 00s
✔️ noop SUCCESS in 0s
✔️ cifmw-pod-ansible-test SUCCESS in 9m 17s
✔️ cifmw-pod-pre-commit SUCCESS in 8m 25s
✔️ cifmw-molecule-federation SUCCESS in 2m 07s

@xek xek force-pushed the oidc-auth-tests branch from eac6c88 to db1eb85 Compare April 30, 2026 11:39
@jagee

jagee commented Apr 30, 2026

Copy link
Copy Markdown
Contributor

The new jq changes in the shell scripts looks good. yes we can remove the run_openstack_auth_test.yml, it was a left over from when i originaly wrote the role. lgtm

@xek
[federation] Add OIDC authentication flows tests
d9776b0 
This adds support for testing all OIDC authentication methods:
- v3oidcpassword (Resource Owner Password Credentials)
- v3oidcclientcredentials (Client Credentials)
- v3oidcaccesstoken (Access Token Reuse)
- v3oidcauthcode (Authorization Code)

Note: v3oidcdeviceauthz requires Python 3.10+ and is not
available in OSP18 which ships with Python 3.9.

Assisted-by: Claude Opus
Signed-off-by: Grzegorz Grasza <xek@redhat.com>
@xek xek force-pushed the oidc-auth-tests branch from db1eb85 to d9776b0 Compare May 15, 2026 07:44
@github-actions

github-actions Bot commented May 31, 2026

Copy link
Copy Markdown

This PR is stale because it has been for over 15 days with no activity.
Remove stale label or comment or this will be closed in 7 days.

@github-actions github-actions Bot added the Stale label May 31, 2026
evallesp
evallesp approved these changes Jun 1, 2026
View reviewed changes

@evallesp evallesp left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci openshift-ci Bot added the lgtm label Jun 1, 2026
@github-actions github-actions Bot removed the Stale label Jun 2, 2026
@github-actions

github-actions Bot commented Jun 17, 2026

Copy link
Copy Markdown

This PR is stale because it has been for over 15 days with no activity.
Remove stale label or comment or this will be closed in 7 days.

@github-actions github-actions Bot added the Stale label Jun 17, 2026
michburk
michburk approved these changes Jun 17, 2026
View reviewed changes

@michburk michburk left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@openshift-ci

openshift-ci Bot commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: michburk

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-merge-bot openshift-merge-bot Bot merged commit 8a15a5f into openstack-k8s-operators:main Jun 17, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@evallesp evallesp evallesp approved these changes
@michburk michburk michburk approved these changes
@jagee jagee jagee left review comments
@amartyasinha amartyasinha Awaiting requested review from amartyasinha
@brjackma brjackma Awaiting requested review from brjackma
@danpawlik danpawlik Awaiting requested review from danpawlik

Assignees

@evallesp evallesp

@michburk michburk

Labels

approved lgtm Ready For Review Stale

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@xek @michburk @jagee @danpawlik @evallesp