docker-compose: updates for ipa-tuura + keycloak

Test containers and Makefiles to build test environment included. 1. Container src/Containerfile -- defines systemd container to build src/Makefile -- defines container build steps in make form src/install/ipa-tuura.env -- ipa-tuura service env file for container src/install/ipa-tuura.service -- ipa-tuura systemd service file for container 2. Docker Compose docker-compose.yml -- defines containerized test env Makefile -- defines test env setup steps in make form .env -- Variables for Makefile data/configs/dnsmasq.conf -- config for dns container data/configs/nm_zone_test.conf -- config for dns container env.containers -- env vars for containers. mostly used by keycloak src/install/setup_bridge.sh -- add SCIM plugin config to keycloak for ipa-tuura bridge 3. Networking Info for containers reset to original 4. README.md update to show how to start the container test environment Signed-off-by: Scott Poore <[email protected]>
freeipa · Mar 24, 2023 · 2d1e350 · 2d1e350
1 parent 7d1c51d
commit 2d1e350
Show file tree

Hide file tree

Showing 11 changed files with 360 additions and 20 deletions.
diff --git a/.env b/.env
@@ -2,3 +2,11 @@
 # Copy it to .env or use --env-file=env.example on docker-compose command.
 REGISTRY=quay.io/ftrivino
 TAG=latest
+KC_TAG=19.0.3
+# KITE = Keycloak Integration Test Environment
+CI_PREFIX=kite
+PLUGIN_TAG=kc19_intg
+PLUGIN_VER=0.0.1
+PLUGIN_DIR=scim-keycloak-user-storage-spi-${PLUGIN_TAG}
+PLUGIN_JAR=scim-user-spi-0.0.1-SNAPSHOT.jar
+KCADM="podman exec -it kite-keycloak /opt/keycloak/bin/kcadm.sh"
diff --git a/Makefile b/Makefile
@@ -0,0 +1,56 @@
+include .env
+
+up: datadir cert plugin
+	docker-compose up --detach
+
+stop:
+	docker-compose stop
+
+down: stop
+	docker-compose down
+
+datadir:
+ifeq (,$(wildcard data/keycloak))
+	mkdir -p data/keycloak
+endif
+
+#cert: datadir ipaca
+cert: datadir
+ifeq (,$(wildcard data/keycloak/server.crt))
+	cd data/configs && \
+	openssl req -x509 -nodes -newkey rsa:4096 -keyout server.key \
+		-out server.crt -sha256 -days 365 -subj '/CN=master.keycloak.test' && \
+	mv server.* ../keycloak && \
+	cd ../keycloak && \
+	keytool -import -keystore server.keystore \
+		-file server.crt -alias truststore \
+		-trustcacerts -storepass Secret123 -noprompt && \
+	chown 1000 server.*
+endif
+
+ipaca:
+ifeq (,$(wildcard data/keycloak/ipaca.crt))
+	cd data/keycloak && \
+	curl -o ipaca.crt http://master.ipa.test/ipa/config/ca.crt && \
+	chown 1000 server.*
+endif
+
+container:
+	$(MAKE) -C src
+
+plugin: datadir
+ifeq (,$(wildcard data/keycloak/$(PLUGIN_JAR)))
+	cd data/keycloak && \
+	wget https://github.com/justin-stephenson/scim-keycloak-user-storage-spi/archive/refs/tags/$(PLUGIN_TAG).tar.gz && \
+	tar zxvf $(PLUGIN_TAG).tar.gz && \
+	pushd $(PLUGIN_DIR) && \
+	mvn clean package && \
+	mv target/$(PLUGIN_JAR) ../
+endif
+
+bridge:
+	source ./env.containers && \
+	bash -c "src/install/setup_bridge.sh"
+
+clean:
+	rm -rf data/keycloak/*
diff --git a/README.md b/README.md
@@ -94,3 +94,87 @@ make html
 ```
 
 The generated documentation will be available at `$IPA_TUURA/doc/_build/html/` folder.
+
+
+### Testing
+
+Provided is a docker-compose.yml container based test environment.  Running this
+environment on a system will provide the containers needed for testing some of the
+basic features of ipa-tuura:
+
+* ipa-tuura running SCIMv2 Bridge
+* Keycloak running with the SCIMv2 User Storage plugin
+* FreeIPA to provide IPA service
+* LDAP container to provide LDAP service
+* DNS container to provide static DNS for the test environment
+* Nextcloud to provide End to End application authentication testing
+
+
+First Install required packages needed to run container test environment:
+
+```bash
+sudo dnf -y install podman docker-compose podman-docker \
+                    java-17-openjdk-headless maven dnsmasq
+```
+
+Start podman service:
+
+```bash
+sudo systemctl start podman
+```
+
+Clone this repository:
+
+```bash
+git clone https://github.com/freeipa/ipa-tuura
+cd ipa-tuura
+```
+
+Set SELinux boolean:
+
+```bash
+sudo setsebool -P container_manage_cgroup true
+```
+
+OPTIONAL: Note if you want to setup your local DNS to resolve the container
+hostnames, you can follow these steps:
+
+```bash
+sudo cp data/configs/nm_enable_dnsmasq.conf /etc/NetworkManager/conf.d/
+sudo cp data/configs/nm_zone_test.conf /etc/NetworkManager/dnsmasq.d/
+sudo systemctl disable --now systemd-resolved
+sudo mv /etc/resolv.conf /etc/resolv.conf.ipa-tuura-backup
+sudo systemctl reload NetworkManager
+```
+
+Start containers:
+
+```bash
+sudo make up
+sudo make bridge
+```
+
+Note that the container names all start with "kite-" which stands for Keycloak
+Integration Test Environment.  Each container is named after the service it
+provides to make access easier.
+
+Now you can access the containers with either:
+
+```bash
+sudo podman exec -it kite-<service> bash
+```
+
+Or for some containers, you can access with ssh.  To do so, lookup IP from 
+docker-compose.yml file.
+
+```bash
+ssh root@<IP>
+```
+
+To run Keycloak or IPA commands, you can alias the commands like this:
+
+```bash
+alias kcadm='sudo podman exec -it kite-keycloak /opt/keycloak/bin/kcadm.sh'
+alias ipa='sudo podman exec -it kite-ipa ipa'
+```
+
diff --git a/data/configs/dnsmasq.conf b/data/configs/dnsmasq.conf
@@ -9,19 +9,25 @@ local=/test/
 
 # These zones have their own DNS server
 server=/ipa.test/172.16.100.10
-server=/samba.test/172.16.100.30
 server=/ad.test/172.16.200.10
 
 # Add A records for LDAP and client machines
 address=/master.ldap.test/172.16.100.20
 address=/client.test/172.16.100.40
+address=/master.keycloak.test/172.16.100.11
+address=/master.nextcloud.test/172.16.100.12
+address=/master.mariadb.test/172.16.100.13
+address=/ipa-tuura.bridge.test/172.16.100.14
 
 # Add SRV record for LDAP
 srv-host=_ldap._tcp.ldap.test,master.ldap.test,389
 
 # Add PTR records for all machines
 ptr-record=10.100.16.172.in-addr.arpa,master.ipa.test
+ptr-record=11.100.16.172.in-addr.arpa,master.keycloak.test
+ptr-record=12.100.16.172.in-addr.arpa,master.nextcloud.test
+ptr-record=13.100.16.172.in-addr.arpa,master.mariadb.test
+ptr-record=14.100.16.172.in-addr.arpa,ipa-tuura.bridge.test
 ptr-record=20.100.16.172.in-addr.arpa,master.ldap.test
-ptr-record=30.100.16.172.in-addr.arpa,dc.samba.test
 ptr-record=40.100.16.172.in-addr.arpa,client.test
 ptr-record=10.200.16.172.in-addr.arpa,dc.ad.test
diff --git a/docker-compose.yml b/docker-compose.yml
@@ -2,7 +2,7 @@ services:
   dns:
     restart: always
     image: ${REGISTRY}/ci-dns:latest
-    container_name: dns
+    container_name: ${CI_PREFIX}-dns
     env_file: ./env.containers
     volumes:
     - ./data/configs/dnsmasq.conf:/etc/dnsmasq.conf
@@ -14,12 +14,12 @@ services:
     - label=disable
     - seccomp=unconfined
     networks:
-      sssd:
+      ipa-tuura:
         ipv4_address: 172.16.100.2
 
   ipa:
     image: ${REGISTRY}/ci-ipa:${TAG}
-    container_name: ipa
+    container_name: ${CI_PREFIX}-ipa
     hostname: master.ipa.test
     dns: 172.16.100.2
     env_file: ./env.containers
@@ -29,22 +29,55 @@ services:
     - SYS_ADMIN
     - SYS_PTRACE
     - AUDIT_WRITE
+    - SYS_CHROOT
+    - NET_ADMIN
     security_opt:
     - apparmor=unconfined
     - label=disable
     - seccomp=unconfined
     networks:
-      sssd:
+      ipa-tuura:
         ipv4_address: 172.16.100.10
 
+  ipa-tuura:
+    image: quay.io/idmops/bridge:latest
+    #image: localhost/ipa-tuura/base:latest
+    container_name: ${CI_PREFIX}-ipa-tuura
+    hostname: ipa-tuura.bridge.test
+    ports:
+    - 8000:8000
+    dns: 172.16.100.2
+    env_file: ./env.containers
+    volumes:
+    - ./shared:/shared:rw
+    cap_add:
+    - SYS_ADMIN
+    - SYS_PTRACE
+    - AUDIT_WRITE
+    security_opt:
+    - apparmor=unconfined
+    - label=disable
+    - seccomp=unconfined
+    networks:
+      ipa-tuura:
+        ipv4_address: 172.16.100.14
+
   keycloak:
-    image: ${REGISTRY}/keycloak:${TAG}
-    container_name: keycloak
+    #image: ${REGISTRY}/keycloak:${TAG}
+    image: quay.io/keycloak/keycloak:${KC_TAG}
+    container_name: ${CI_PREFIX}-keycloak
     hostname: master.keycloak.test
+    ports:
+    - 8443:8443
     dns: 172.16.100.2
     env_file: ./env.containers
     volumes:
-    - ./shared:/shared:rw
+    #- ./shared:/shared:rw
+    - ./data/keycloak/server.crt:/opt/keycloak/conf/server.crt
+    - ./data/keycloak/server.key:/opt/keycloak/conf/server.key
+    - ./data/keycloak/server.keystore:/opt/keycloak/conf/server.keystore
+    - ./data/keycloak/ipaca.crt:/etc/ipaca.crt
+    - ./data/keycloak/scim-user-spi-${PLUGIN_VER}-SNAPSHOT.jar:/opt/keycloak/providers/scim.jar
     cap_add:
     - SYS_ADMIN
     - SYS_PTRACE
@@ -53,12 +86,17 @@ services:
     - apparmor=unconfined
     - label=disable
     - seccomp=unconfined
+    entrypoint:
+    - /opt/keycloak/bin/kc.sh
+    - start
+    - --log-level=INFO,org.apache.http.wire:debug,org.keycloak:debug
     networks:
-      sssd:
+      ipa-tuura:
         ipv4_address: 172.16.100.11
+
   nextcloud:
     image: ${REGISTRY}/nextcloud:${TAG}
-    container_name: nextcloud
+    container_name: ${CI_PREFIX}-nextcloud
     hostname: master.nextcloud.test
     dns: 172.16.100.2
     env_file: ./env.containers
@@ -73,11 +111,11 @@ services:
     - label=disable
     - seccomp=unconfined
     networks:
-      sssd:
+      ipa-tuura:
         ipv4_address: 172.16.100.12
   mariadb:
     image: ${REGISTRY}/mariadb:${TAG}
-    container_name: mariadb
+    container_name: ${CI_PREFIX}-mariadb
     hostname: master.mariadb.test
     dns: 172.16.100.2
     env_file: ./env.containers
@@ -92,11 +130,12 @@ services:
     - label=disable
     - seccomp=unconfined
     networks:
-      sssd:
+      ipa-tuura:
         ipv4_address: 172.16.100.13
+
   ldap:
     image: ${REGISTRY}/ci-ldap:${TAG}
-    container_name: ldap
+    container_name: ${CI_PREFIX}-ldap
     hostname: master.ldap.test
     dns: 172.16.100.2
     env_file: ./env.containers
@@ -110,11 +149,12 @@ services:
     - label=disable
     - seccomp=unconfined
     networks:
-      sssd:
+      ipa-tuura:
         ipv4_address: 172.16.100.20
+
   client:
     image: ${REGISTRY}/ci-client:${TAG}
-    container_name: client
+    container_name: ${CI_PREFIX}-client
     hostname: client.test
     dns: 172.16.100.2
     env_file: ./env.containers
@@ -129,11 +169,12 @@ services:
     - label=disable
     - seccomp=unconfined
     networks:
-      sssd:
+      ipa-tuura:
         ipv4_address: 172.16.100.40
+
 networks:
-  sssd:
-    name: sssd-ci
+  ipa-tuura:
+    name: ipa-tuura-ci
     driver: bridge
     ipam:
      config:

diff --git a/env.containers b/env.containers
@@ -1,2 +1,11 @@
 # Environment variables set in all started containers
 CONTAINER=yes
+KEYCLOAK_ADMIN=admin
+KEYCLOAK_ADMIN_PASSWORD=Secret123
+KC_HOSTNAME=master.keycloak.test
+KC_HOSTNAME_PORT=8443
+KC_HTTPS_CERTIFICATE_FILE=/opt/keycloak/conf/server.crt
+KC_HTTPS_CERTIFICATE_KEY_FILE=/opt/keycloak/conf/server.key
+KC_HTTPS_TRUST_STORE_FILE=/opt/keycloak/conf/server.keystore
+KC_HTTPS_TRUST_STORE_PASSWORD=Secret123
+KC_HTTP_RELATIVE_PATH=/auth