Skip to content

Commit af8636a

Browse files
DiamondJosephDiamondJoseph
committed
Configure system tests to work with Tiled autz
1 parent fedd16a commit af8636a

File tree

10 files changed

+350
-50
lines changed

10 files changed

+350
-50
lines changed

‎pyproject.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ classifiers = [
1313
]
1414
description = "Lightweight bluesky-as-a-service wrapper application. Also usable as a library."
1515
dependencies = [
16-
"tiled[client]>=0.2.0",
16+
"tiled[client]@git+https://git@github.com/zohebshaikh/tiled@v0.4.17",
1717
"bluesky[plotting]>=1.14.0", # plotting includes matplotlib, required for BestEffortCallback in run plans
1818
"ophyd-async>=0.13.5",
1919
"aioca",

‎tests/system_tests/compose.yaml‎

Lines changed: 49 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,56 @@ services:
1919
target: /etc/rabbitmq/enabled_plugins
2020

2121
tiled:
22-
image: ghcr.io/bluesky/tiled:0.2.0
22+
image: ghcr.io/zohebshaikh/tiled:0.4.17
2323
ports:
2424
- "8407:8000"
25+
volumes:
26+
- ./services/tiled_config:/deploy/config
27+
command: ["tiled", "serve", "config", "--host", "0.0.0.0", "--port", "8000"]
28+
depends_on:
29+
keycloak:
30+
condition: service_healthy
31+
32+
keycloak:
33+
image: keycloak/keycloak:26.4
2534
environment:
26-
- TILED_SINGLE_USER_API_KEY=${TILED_SINGLE_USER_API_KEY}
35+
- KC_BOOTSTRAP_ADMIN_PASSWORD=admin
36+
- KC_BOOTSTRAP_ADMIN_USERNAME=admin
37+
command: ["start-dev"]
2738
volumes:
28-
- ./services/tiled_config:/deploy/config
39+
- ./services/keycloak_config/:/mnt
40+
post_start:
41+
- command: bash /mnt/startup.sh
42+
ports:
43+
- 8081:8080
44+
healthcheck:
45+
test: /opt/keycloak/bin/kcadm.sh config credentials --server http://keycloak:8080 --realm master --user admin --password admin
46+
interval: 5s
47+
timeout: 5s
48+
retries: 10
49+
start_period: 30s
50+
51+
opa:
52+
image: openpolicyagent/opa
53+
volumes:
54+
- ./services/opa_config/config.yaml:/mnt/config.yaml
55+
- ./services/opa_config/opa_data/bundle.tar.gz:/mnt/bundle.tar.gz
56+
environment:
57+
- ISSUER=http://keycloak:8080/realms/master
58+
command:
59+
[
60+
"run",
61+
"--server",
62+
"--addr",
63+
":8181",
64+
"-b",
65+
"/mnt/bundle.tar.gz",
66+
"--config-file",
67+
"/mnt/config.yaml",
68+
]
69+
entrypoint: "/opa"
70+
ports:
71+
- 8181:8181
72+
depends_on:
73+
keycloak:
74+
condition: service_healthy

‎tests/system_tests/config.yaml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,4 +17,8 @@ numtracker:
1717
url: http://localhost:8406/graphql
1818
tiled:
1919
enabled: true
20-
url: http://localhost:8407/
20+
url: http://localhost:8407/api/v1
21+
oidc:
22+
well_known_url: "http://localhost:8081/realms/master/.well-known/openid-configuration"
23+
client_id: "blueapi"
24+
client_audience: "blueapi"

‎tests/system_tests/services/keycloak_config/blueapi-ci.json‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
{
2+
"clientId": "blueapi",
3+
"name": "Blueapi",
4+
"description": "Service account client used to run automated system tests for Blueapi.",
5+
"rootUrl": "",
6+
"adminUrl": "",
7+
"baseUrl": "",
8+
"surrogateAuthRequired": false,
9+
"enabled": true,
10+
"alwaysDisplayInConsole": false,
11+
"clientAuthenticatorType": "client-secret",
12+
"secret": "secret",
13+
"redirectUris": [
14+
"/*"
15+
],
16+
"webOrigins": [
17+
"/*"
18+
],
19+
"notBefore": 0,
20+
"bearerOnly": false,
21+
"consentRequired": false,
22+
"standardFlowEnabled": false,
23+
"implicitFlowEnabled": false,
24+
"directAccessGrantsEnabled": false,
25+
"serviceAccountsEnabled": true,
26+
"publicClient": false,
27+
"frontchannelLogout": true,
28+
"protocol": "openid-connect",
29+
"attributes": {
30+
"realm_client": "false",
31+
"oidc.ciba.grant.enabled": "false",
32+
"client.secret.creation.time": "1748358661",
33+
"backchannel.logout.session.required": "true",
34+
"standard.token.exchange.enabled": "false",
35+
"oauth2.device.authorization.grant.enabled": "false",
36+
"display.on.consent.screen": "false",
37+
"backchannel.logout.revoke.offline.tokens": "false",
38+
"dpop.bound.access.tokens": "false"
39+
},
40+
"authenticationFlowBindingOverrides": {},
41+
"fullScopeAllowed": true,
42+
"nodeReRegistrationTimeout": -1,
43+
"protocolMappers": [
44+
{
45+
"name": "Client Host",
46+
"protocol": "openid-connect",
47+
"protocolMapper": "oidc-usersessionmodel-note-mapper",
48+
"consentRequired": false,
49+
"config": {
50+
"user.session.note": "clientHost",
51+
"introspection.token.claim": "true",
52+
"userinfo.token.claim": "true",
53+
"id.token.claim": "true",
54+
"access.token.claim": "true",
55+
"claim.name": "clientHost",
56+
"jsonType.label": "String"
57+
}
58+
},
59+
{
60+
"name": "alice",
61+
"protocol": "openid-connect",
62+
"protocolMapper": "oidc-hardcoded-claim-mapper",
63+
"consentRequired": false,
64+
"config": {
65+
"introspection.token.claim": "true",
66+
"claim.value": "alice",
67+
"userinfo.token.claim": "true",
68+
"id.token.claim": "true",
69+
"lightweight.claim": "false",
70+
"access.token.claim": "true",
71+
"claim.name": "fedid",
72+
"jsonType.label": "String",
73+
"access.tokenResponse.claim": "false"
74+
}
75+
},
76+
{
77+
"name": "Client ID",
78+
"protocol": "openid-connect",
79+
"protocolMapper": "oidc-usersessionmodel-note-mapper",
80+
"consentRequired": false,
81+
"config": {
82+
"user.session.note": "client_id",
83+
"introspection.token.claim": "true",
84+
"userinfo.token.claim": "true",
85+
"id.token.claim": "true",
86+
"access.token.claim": "true",
87+
"claim.name": "client_id",
88+
"jsonType.label": "String"
89+
}
90+
},
91+
{
92+
"name": "Client IP Address",
93+
"protocol": "openid-connect",
94+
"protocolMapper": "oidc-usersessionmodel-note-mapper",
95+
"consentRequired": false,
96+
"config": {
97+
"user.session.note": "clientAddress",
98+
"introspection.token.claim": "true",
99+
"userinfo.token.claim": "true",
100+
"id.token.claim": "true",
101+
"access.token.claim": "true",
102+
"claim.name": "clientAddress",
103+
"jsonType.label": "String"
104+
}
105+
},
106+
{
107+
"name": "blueapi",
108+
"protocol": "openid-connect",
109+
"protocolMapper": "oidc-audience-mapper",
110+
"consentRequired": false,
111+
"config": {
112+
"id.token.claim": "false",
113+
"lightweight.claim": "false",
114+
"introspection.token.claim": "true",
115+
"access.token.claim": "true",
116+
"included.custom.audience": "blueapi",
117+
"userinfo.token.claim": "false"
118+
}
119+
}
120+
],
121+
"defaultClientScopes": [
122+
"web-origins",
123+
"service_account",
124+
"acr",
125+
"roles",
126+
"profile",
127+
"basic",
128+
"email"
129+
],
130+
"optionalClientScopes": [
131+
"address",
132+
"phone",
133+
"offline_access",
134+
"organization",
135+
"microprofile-jwt"
136+
],
137+
"access": {
138+
"view": true,
139+
"configure": true,
140+
"manage": true
141+
}
142+
}

‎tests/system_tests/services/keycloak_config/startup.sh‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#!/bin/bash
2+
export PATH=$PATH:/opt/keycloak/bin
3+
4+
sleep 30
5+
while ! kcadm.sh config credentials --server http://localhost:8080 --realm master --user admin --password admin; do
6+
sleep 1
7+
done
8+
9+
# Add users to Keycloak
10+
for user in alice bob carol; do
11+
kcadm.sh create users -r master -s username="$user" -s enabled=true
12+
kcadm.sh set-password -r master --username "$user" --new-password "$user"
13+
done
14+
15+
allowed_protocol_mappers=$(kcadm.sh get components -q name="Allowed Protocol Mapper Types" --fields id --format csv --noquotes)
16+
allowed_client_scopes=$(kcadm.sh get components -q name="Allowed Client Scopes" --fields id --format csv --noquotes)
17+
for i in $allowed_protocol_mappers $allowed_client_scopes;do
18+
kcadm.sh delete components/$i
19+
done
20+
21+
kcreg.sh config credentials --server http://localhost:8080 --realm master --user admin --password admin
22+
client="ixx-blueapi"
23+
kcreg.sh get $client >/dev/null 2>&1 || kcreg.sh create --file "/mnt/$client.json"

‎tests/system_tests/services/opa_config/config.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
services:
2+
ghcr:
3+
url: https://ghcr.io
4+
type: oci
5+
bundles:
6+
diamond-policies:
7+
service: ghcr
8+
resource: ghcr.io/diamondjoseph/authz-policy:0.1.15
9+
polling:
10+
min_delay_seconds: 30
11+
max_delay_seconds: 120

‎tests/system_tests/services/opa_config/opa_data/data.json‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
{
2+
"diamond": {
3+
"data": {
4+
"beamlines": {
5+
"adsim": {
6+
"sessions": [
7+
"1"
8+
]
9+
}
10+
},
11+
"proposals": {
12+
"12345": {
13+
"sessions": {
14+
"1": 1
15+
}
16+
}
17+
},
18+
"sessions": {
19+
"1": {
20+
"beamline": "adsim",
21+
"proposal_number": 1,
22+
"visit_number": 1
23+
}
24+
},
25+
"subjects": {
26+
"alice": {
27+
"permissions": [],
28+
"proposals": [
29+
1
30+
],
31+
"sessions": [
32+
1
33+
]
34+
}
35+
}
36+
}
37+
}
38+
}

‎tests/system_tests/services/tiled_config/config.yml‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,24 @@
11
authentication:
2-
# Any HTTP client that can connect can read, an API key is still required to write.
3-
allow_anonymous_access: true
2+
providers:
3+
- provider: keycloak_oidc
4+
authenticator: tiled.authenticators:ProxiedOIDCAuthenticator
5+
args:
6+
audience: account
7+
client_id: tiled
8+
device_flow_client_id: tiled-cli
9+
well_known_uri: "http://keycloak:8080/realms/master/.well-known/openid-configuration"
10+
confirmation_message: "You have logged in with authn.diamond.ac.uk as {id}."
411
trees:
512
- path: /
613
tree: catalog
714
args:
815
uri: "sqlite:////storage/catalog.db"
916
writable_storage: "sqlite:////storage/catalog.db"
1017
init_if_not_exists: true
18+
19+
access_control:
20+
access_policy: "tiled.access_control.dls:DiamondOpenPolicyAgentAuthorizationPolicy"
21+
args:
22+
authorization_provider: "http://opa:8181/v1/data/diamond/policy/"
23+
token_audience: account
24+
empty_access_blob_public: true

0 commit comments

Comments
 (0)