Implement confidential OIDC authentication boundary

tests/kind/lib.sh

@@ -197,6 +197,7 @@ render_manifests() {
     -e "s|@@GARAGE_IMAGE@@|$garage|g" \
     -e "s|@@VERSITYGW_IMAGE@@|$versitygw|g" \
     -e "s|@@COREDNS_IMAGE@@|$coredns|g" \
+    -e "s|@@CURL_IMAGE@@|$curl|g" \
     -e "s|@@AWS_CLI_IMAGE@@|$aws_cli|g" \
     -e "s|@@POSTGRES_REPLICAS@@|$postgres_replicas|g" \
     -e "s|@@REDIS_REPLICAS@@|$redis_replicas|g" \
@@ -528,6 +529,153 @@ provision_lane_target_principal() {
   printf -v "$secret_key_var" '%s' "$secret_key"
 }
 
+keycloak_admin_token() {
+  kube --namespace "$FIXTURE_NAMESPACE" exec deployment/keycloak -- \
+    sh -ec '
+      /opt/keycloak/bin/kcadm.sh config credentials \
+        --server http://127.0.0.1:8080 \
+        --realm master \
+        --user nuthatch-admin \
+        --password synthetic-keycloak >/dev/null
+      /opt/keycloak/bin/kcadm.sh get serverinfo >/dev/null
+    ' >/dev/null
+}
+
+provision_lane_keycloak_registration() {
+  local lane="$1"
+  local redirect_uri="$2"
+  local client_id_var="$3"
+  local client_secret_var="$4"
+  local additional_audiences_var="$5"
+  local user_a_var="$6"
+  local user_b_var="$7"
+  local client_id="nuthatch-$lane"
+  local client_secret="synthetic-keycloak-client-secret-$lane"
+  local username
+  keycloak_admin_token || return
+  kube --namespace "$FIXTURE_NAMESPACE" exec deployment/keycloak -- \
+    /opt/keycloak/bin/kcadm.sh create clients \
+      --realm master \
+      -s "clientId=$client_id" \
+      -s enabled=true \
+      -s protocol=openid-connect \
+      -s publicClient=false \
+      -s clientAuthenticatorType=client-secret \
+      -s standardFlowEnabled=true \
+      -s directAccessGrantsEnabled=false \
+      -s "secret=$client_secret" \
+      -s "redirectUris=[\"$redirect_uri\"]" \
+      -s 'attributes={"pkce.code.challenge.method":"S256"}' >/dev/null || return
+  for username in "nuthatch-$lane-a" "nuthatch-$lane-b"; do
+    kube --namespace "$FIXTURE_NAMESPACE" exec deployment/keycloak -- \
+      /opt/keycloak/bin/kcadm.sh create users \
+        --realm master \
+        -s "username=$username" \
+        -s enabled=true \
+        -s "firstName=$username" >/dev/null || return
+    kube --namespace "$FIXTURE_NAMESPACE" exec deployment/keycloak -- \
+      /opt/keycloak/bin/kcadm.sh set-password \
+        --realm master \
+        --username "$username" \
+        --new-password Synthetic-OIDC-1! >/dev/null || return
+  done
+  printf -v "$client_id_var" '%s' "$client_id"
+  printf -v "$client_secret_var" '%s' "$client_secret"
+  printf -v "$additional_audiences_var" ''
+  printf -v "$user_a_var" '%s' "nuthatch-$lane-a"
+  printf -v "$user_b_var" '%s' "nuthatch-$lane-b"
+}
+
+zitadel_api() {
+  local token_path="$1"
+  local method="$2"
+  local path="$3"
+  local body="$4"
+  kube --namespace "$FIXTURE_NAMESPACE" exec \
+    deployment/zitadel \
+    --container oidc-provisioner \
+    -- sh -ec '
+      token="$(tr -d "\r\n" < "$1")"
+      curl --fail --silent --show-error \
+        --request "$2" \
+        --header "Host: zitadel.nuthatch.test" \
+        --header "Authorization: Bearer $token" \
+        --header "Content-Type: application/json" \
+        --data "$4" \
+        "http://127.0.0.1:8080$3"
+    ' sh "$token_path" "$method" "$path" "$body"
+}
+
+provision_lane_zitadel_registration() {
+  local lane="$1"
+  local redirect_uri="$2"
+  local client_id_var="$3"
+  local client_secret_var="$4"
+  local additional_audiences_var="$5"
+  local user_a_var="$6"
+  local user_b_var="$7"
+  local project_response
+  local project_id
+  local app_response
+  local client_id
+  local client_secret
+  local username
+  local user_response
+  local user_ids=()
+  project_response="$(
+    zitadel_api \
+      /bootstrap/admin.pat \
+      POST \
+      /management/v1/projects \
+      "{\"name\":\"Nuthatch lane $lane\"}"
+  )" || return
+  project_id="$(jq -er .id <<< "$project_response")" || return
+  app_response="$(
+    zitadel_api \
+      /bootstrap/admin.pat \
+      POST \
+      "/management/v1/projects/$project_id/apps/oidc" \
+      "{\"projectId\":\"$project_id\",\"name\":\"Nuthatch lane $lane\",\"redirectUris\":[\"$redirect_uri\"],\"responseTypes\":[\"OIDC_RESPONSE_TYPE_CODE\"],\"grantTypes\":[\"OIDC_GRANT_TYPE_AUTHORIZATION_CODE\"],\"appType\":\"OIDC_APP_TYPE_WEB\",\"authMethodType\":\"OIDC_AUTH_METHOD_TYPE_BASIC\",\"version\":\"OIDC_VERSION_1_0\",\"devMode\":false}"
+  )" || return
+  client_id="$(jq -er .clientId <<< "$app_response")" || return
+  client_secret="$(jq -er .clientSecret <<< "$app_response")" || return
+  for username in "nuthatch-$lane-a" "nuthatch-$lane-b"; do
+    user_response="$(
+      zitadel_api \
+        /bootstrap/admin.pat \
+        POST \
+        /management/v1/users/human \
+        "{\"userName\":\"$username\",\"profile\":{\"firstName\":\"Nuthatch\",\"lastName\":\"$username\",\"displayName\":\"$username\",\"preferredLanguage\":\"en\"},\"email\":{\"email\":\"$username@example.test\",\"isEmailVerified\":true},\"initialPassword\":\"Synthetic-OIDC-1!\"}"
+    )" || return
+    user_ids+=("$(jq -er .userId <<< "$user_response")") || return
+  done
+  printf -v "$client_id_var" '%s' "$client_id"
+  printf -v "$client_secret_var" '%s' "$client_secret"
+  printf -v "$additional_audiences_var" '%s' "$project_id"
+  printf -v "$user_a_var" '%s' "${user_ids[0]}"
+  printf -v "$user_b_var" '%s' "${user_ids[1]}"
+}
+
+create_oidc_automation_secret() {
+  local lane="$1"
+  local provider="$2"
+  local login_pat=unused
+  if [[ "$provider" = zitadel ]]; then
+    login_pat="$(
+      kube --namespace "$FIXTURE_NAMESPACE" exec \
+        deployment/zitadel \
+        --container oidc-provisioner \
+        -- sh -ec 'tr -d "\r\n" < /bootstrap/login-client.pat'
+    )" || return
+  fi
+  kube create secret generic "nuthatch-oidc-automation-$lane" \
+    --namespace "$FIXTURE_NAMESPACE" \
+    --from-literal="NUTHATCH_OIDC_LOGIN_PAT=$login_pat" \
+    --dry-run=client \
+    --output yaml |
+    kube apply --filename - >/dev/null
+}
+
 write_lane_profile() {
   local lane="$1"
   local coordination="$2"
@@ -538,6 +686,12 @@ write_lane_profile() {
   local database=
   local coordination_database=
   local oidc_issuer=
+  local oidc_client_id=
+  local oidc_client_secret=
+  local oidc_additional_audiences=
+  local oidc_redirect_uri=
+  local oidc_user_a=
+  local oidc_user_b=
   local target_url=
   local target_bucket=
   local target_region=
@@ -550,11 +704,36 @@ write_lane_profile() {
     coordination_database="$(reset_lane_coordination_store "$coordination" "$lane")" || return
   fi
   if fixture_has_family oidc; then
+    oidc_redirect_uri="https://nuthatch-$lane:8080/oidc/callback"
     case "$oidc" in
       keycloak) oidc_issuer=http://keycloak.nuthatch.test:8080/realms/master ;;
       zitadel) oidc_issuer=http://zitadel.nuthatch.test:8080 ;;
       *) return 1 ;;
     esac
+    case "$oidc" in
+      keycloak)
+        provision_lane_keycloak_registration \
+          "$lane" \
+          "$oidc_redirect_uri" \
+          oidc_client_id \
+          oidc_client_secret \
+          oidc_additional_audiences \
+          oidc_user_a \
+          oidc_user_b || return
+        ;;
+      zitadel)
+        provision_lane_zitadel_registration \
+          "$lane" \
+          "$oidc_redirect_uri" \
+          oidc_client_id \
+          oidc_client_secret \
+          oidc_additional_audiences \
+          oidc_user_a \
+          oidc_user_b || return
+        ;;
+      *) return 1 ;;
+    esac
+    create_oidc_automation_secret "$lane" "$oidc" || return
   fi
   if fixture_has_family target; then
     target_bucket="nuthatch-lane-$lane"
@@ -581,6 +760,12 @@ write_lane_profile() {
     printf 'NUTHATCH_PG_CONN=host=postgres port=5432 user=nuthatch password=synthetic-postgres dbname=%s\n' "$database"
     printf 'NUTHATCH_REDIS_URL=redis://%s:6379/%s\n' "$coordination" "$coordination_database"
     printf 'NUTHATCH_OIDC_ISSUER=%s\n' "$oidc_issuer"
+    printf 'NUTHATCH_OIDC_CLIENT_ID=%s\n' "$oidc_client_id"
+    printf 'NUTHATCH_OIDC_ADDITIONAL_AUDIENCES=%s\n' "$oidc_additional_audiences"
+    printf 'NUTHATCH_OIDC_REDIRECT_URI=%s\n' "$oidc_redirect_uri"
+    printf 'NUTHATCH_OIDC_USER_A=%s\n' "$oidc_user_a"
+    printf 'NUTHATCH_OIDC_USER_B=%s\n' "$oidc_user_b"
+    printf 'NUTHATCH_OIDC_USER_PASSWORD=Synthetic-OIDC-1!\n'
     printf 'NUTHATCH_S3_ENDPOINT=%s\n' "$target_url"
     printf 'NUTHATCH_S3_BUCKET=%s\n' "$target_bucket"
     printf 'NUTHATCH_S3_REGION=%s\n' "$target_region"
@@ -588,6 +773,10 @@ write_lane_profile() {
     printf 'NUTHATCH_S3_SECRET_KEY=%s\n' "$target_secret_key"
     printf 'NUTHATCH_S3_PATH_STYLE=true\n'
   } > "$profile_file" || return
+  if fixture_has_family oidc; then
+    printf '%s' "$oidc_client_secret" > "$profile_file.oidc-secret" || return
+    chmod 0600 "$profile_file.oidc-secret" || return
+  fi
   kube create configmap "$profile" \
     --namespace "$FIXTURE_NAMESPACE" \
     --from-env-file="$profile_file" \
@@ -682,8 +871,12 @@ cleanup_lane_resources() {
     "job/$job" \
     "configmap/$profile" \
     "configmap/$profile-file" \
+    "secret/nuthatch-oidc-automation-${profile##*-}" \
     --ignore-not-found >/dev/null || return
-  rm -f "$RUNTIME/$profile.env" "$RUNTIME/$job.yaml"
+  rm -f \
+    "$RUNTIME/$profile.env" \
+    "$RUNTIME/$profile.env.oidc-secret" \
+    "$RUNTIME/$job.yaml"
 }
 
 run_job_matrix() {
@@ -722,6 +915,7 @@ destroy_fixture() {
     "$RUNTIME/probe.yaml" \
     "$RUNTIME/fixture.env" \
     "$RUNTIME"/nuthatch-fixture-lane-*.env \
+    "$RUNTIME"/nuthatch-fixture-lane-*.env.oidc-secret \
     "$RUNTIME"/wp05-app-*.yaml || status=1
   return "$status"
 }