Adding Dex as a mock OIDC

molecule/default/prepare.yml

@@ -0,0 +1,38 @@
+---
+- name: Prepare
+  hosts: molecule
+  gather_facts: false
+  vars_files:
+    - vars/vars.yml
+
+  tasks:
+    - name: Podman
+      package:
+        name: podman
+        state: present
+
+    - name: Create dir
+      file:
+        path: "/etc/dex/config"
+        state: directory
+        mode: "0755"
+
+    - name: Copy Dex config over
+      copy:
+        src: "../../vm-testing/dex-config.yaml"
+        dest: "/etc/dex/config/dex.yaml"
+        mode: "0644"
+
+    - name: Run Dex container
+      shell: |
+          sudo podman run -d \
+          --name dex-idp \
+          -p 5556:5556 \
+          -v /etc/dex/config/dex.yaml:/etc/dex/cfg/dex.yaml:Z \
+          quay.io/asiek/dexidp:v2.32.0 \
+          dex serve /etc/dex/cfg/dex.yaml
+
+    - name: Health check
+      command:
+        cmd: |
+          curl -f http://127.0.0.1:5556/dex/healthz

molecule/default/vars/vars.yml

@@ -1,7 +1,7 @@
 tas_single_node_oidc_issuers:
-  - issuer: "https://keycloak-keycloak-system.apps.platform-sts.pcbk.p1.openshiftapps.com/auth/realms/trusted-artifact-signer"
-    url: "https://keycloak-keycloak-system.apps.platform-sts.pcbk.p1.openshiftapps.com/auth/realms/trusted-artifact-signer"
-    client_id: trusted-artifact-signer
+  - issuer: "http://127.0.0.1:5556/dex"
+    url: "http://127.0.0.1:5556/dex"
+    client_id: example-app
     type: email
 tas_single_node_base_hostname: myrhtas
 tas_single_node_cockpit:

molecule/default/verify.yml

@@ -33,8 +33,7 @@
         recreate: true
         env:
           BASE_HOSTNAME: "{{ tas_single_node_base_hostname }}"
-          USERNAME: "jdoe"
-          PASSWORD: "secure"
+          EMAIL: "[email protected]"
           KEYCLOAK_URL: "https://{{ tas_single_node_oidc_issuers[0].url | urlsplit('hostname') }}"
         # NOTE: we can't add hosts with the etc_hosts parameter, because we would need to template
         # the dictionary keys for it and Ansible doesn't do that

vm-testing/dex-config.yaml

@@ -0,0 +1,38 @@
+issuer: http://127.0.0.1:5556/dex
+
+storage:
+  type: memory
+
+web:
+  http: 0.0.0.0:5556
+
+staticClients:
+- id: example-app
+  redirectURIs:
+  - 'http://127.0.0.1:5556/callback'
+  name: 'Example App'
+  secret: ZXhhbXBsZS1hcHAtc2VjcmV0
+
+connectors:
+- type: mockCallback
+  id: mock
+  name: Example
+
+enablePasswordDB: true
+
+staticPasswords:
+- email: "[email protected]"
+  hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
+  username: "admin"
+  userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"
+
+oauth2:
+  responseTypes: ["code"]
+  alwaysShowLoginScreen: true
+  skipApprovalScreen: true
+  passwordConnection: mock
+
+expiry:
+  signingKeys: "24h"
+  idTokens: "1m"
+  authRequests: "24h"

vm-testing/test/test-sign-blob.sh

@@ -30,7 +30,10 @@ export SIGSTORE_OIDC_ISSUER=$COSIGN_OIDC_ISSUER
 export SIGSTORE_REKOR_URL=$COSIGN_REKOR_URL
 export REKOR_REKOR_SERVER=$COSIGN_REKOR_URL
 
-TOKEN="$(curl -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "username=${USERNAME}" -d "password=${PASSWORD}" -d "grant_type=password" -d "scope=openid" -d "client_id=${KEYCLOAK_REALM}" "${OIDC_ISSUER_URL}"/protocol/openid-connect/token |  sed -E 's/.*"access_token":"([^"]*).*/\1/')"
+AUTHTOKEN="$(curl -Lis "http://127.0.0.1:5556/dex/auth/mock?client_id=example-app&scope=openid%20email&redirect_uri=http://127.0.0.1:5556/callback&response_type=code" | grep -oP "code=\K[^&]+")"
+export AUTHTOKEN
+
+TOKEN="$(curl -s -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "grant_type=authorization_code" -d "code=${AUTHTOKEN}" -d "redirect_uri=http://127.0.0.1:5556/callback" -d "client_id=example-app" -d "client_secret=ZXhhbXBsZS1hcHAtc2VjcmV0" "http://127.0.0.1:5556/dex/token" | sed -E 's/.*"access_token":"([^*]*).*/\1/')"
 export TOKEN
 
 env
@@ -40,4 +43,4 @@ echo "testing" > to-sign
 
 cosign --verbose sign-blob to-sign --bundle signed.bundle --identity-token="${TOKEN}" --timestamp-server-url="${COSIGN_TSA_URL}" --rfc3161-timestamp=timestamp.txt
 
-cosign --verbose verify-blob --certificate-identity="${USERNAME}"@redhat.com --bundle signed.bundle to-sign --rfc3161-timestamp=timestamp.txt --use-signed-timestamps
+cosign --verbose verify-blob --certificate-identity="${EMAIL}" --bundle signed.bundle to-sign --rfc3161-timestamp=timestamp.txt --use-signed-timestamps