Examples with KafkaListenerAuthenticationOAuthBuilder io.strimzi.api.kafka.model.listener.KafkaListenerAuthenticationOAuthBuilder used on opensource projects

Example 1 with KafkaListenerAuthenticationOAuthBuilder

use of io.strimzi.api.kafka.model.listener.KafkaListenerAuthenticationOAuthBuilder in project strimzi by strimzi.

the class ListenersValidatorTest method testValidateOauthPlain.

@ParallelTest
public void testValidateOauthPlain() {
    KafkaListenerAuthenticationOAuthBuilder authBuilder = new KafkaListenerAuthenticationOAuthBuilder().withEnableOauthBearer(false);
    GenericKafkaListenerBuilder listenerBuilder = new GenericKafkaListenerBuilder().withName("listener1").withPort(9900).withType(KafkaListenerType.INTERNAL).withAuth(authBuilder.build());
    GenericKafkaListener listener = listenerBuilder.withAuth(authBuilder.build()).build();
    List<GenericKafkaListener> listeners = asList(listener);
    Exception exception = assertThrows(InvalidResourceException.class, () -> ListenersValidator.validate(Reconciliation.DUMMY_RECONCILIATION, 3, listeners));
    assertThat(exception.getMessage(), allOf(containsString("listener listener1: At least one of 'enablePlain', 'enableOauthBearer' has to be set to 'true'")));
    // enable plain with neither introspectionEndpointUri nor jwksEndpointUri set
    authBuilder.withEnablePlain(true);
    listener = listenerBuilder.withAuth(authBuilder.build()).build();
    List<GenericKafkaListener> listeners2 = asList(listener);
    exception = assertThrows(InvalidResourceException.class, () -> ListenersValidator.validate(Reconciliation.DUMMY_RECONCILIATION, 3, listeners2));
    assertThat(exception.getMessage(), allOf(containsString("listener listener1: Introspection endpoint URI or JWKS endpoint URI has to be specified")));
    // enable plain with jwksEndpointUri set but tokenEndpointUri not set
    authBuilder.withJwksEndpointUri("http://localhost:8080/jwks").withCheckIssuer(false);
    listener = listenerBuilder.withAuth(authBuilder.build()).build();
    List<GenericKafkaListener> listeners3 = asList(listener);
    assertDoesNotThrow(() -> ListenersValidator.validate(Reconciliation.DUMMY_RECONCILIATION, 3, listeners3));
}

Example 2 with KafkaListenerAuthenticationOAuthBuilder

use of io.strimzi.api.kafka.model.listener.KafkaListenerAuthenticationOAuthBuilder in project strimzi by strimzi.

the class ListenersValidatorTest method testValidateCustomClaimCheckOauth.

@ParallelTest
public void testValidateCustomClaimCheckOauth() {
    KafkaListenerAuthenticationOAuthBuilder authBuilder = new KafkaListenerAuthenticationOAuthBuilder().withCustomClaimCheck("invalid");
    GenericKafkaListenerBuilder listenerBuilder = new GenericKafkaListenerBuilder().withName("listener1").withPort(9900).withType(KafkaListenerType.INTERNAL).withAuth(authBuilder.build());
    GenericKafkaListener listener = listenerBuilder.withAuth(authBuilder.build()).build();
    List<GenericKafkaListener> listeners = asList(listener);
    Exception exception = assertThrows(InvalidResourceException.class, () -> ListenersValidator.validate(Reconciliation.DUMMY_RECONCILIATION, 3, listeners));
    assertThat(exception.getMessage(), allOf(containsString("listener listener1: 'customClaimCheck' value not a valid JsonPath filter query - Failed to parse filter query: \"invalid\"")));
    // set valid JsonPath query
    authBuilder.withCustomClaimCheck("@.valid == 'value'");
    listener = listenerBuilder.withAuth(authBuilder.build()).build();
    List<GenericKafkaListener> listeners2 = asList(listener);
    exception = assertThrows(InvalidResourceException.class, () -> ListenersValidator.validate(Reconciliation.DUMMY_RECONCILIATION, 3, listeners2));
    assertThat(exception.getMessage(), allOf(not(containsString("listener listener1: 'customClaimCheck' value not a valid JsonPath filter query - Failed to parse query: \"invalid\" at position: 0"))));
}

Example 3 with KafkaListenerAuthenticationOAuthBuilder

use of io.strimzi.api.kafka.model.listener.KafkaListenerAuthenticationOAuthBuilder in project strimzi by strimzi.

the class KafkaClusterTest method testGenerateDeploymentWithOAuthWithClientSecret.

@ParallelTest
public void testGenerateDeploymentWithOAuthWithClientSecret() {
    Kafka kafkaAssembly = new KafkaBuilder(ResourceUtils.createKafka(namespace, cluster, replicas, image, healthDelay, healthTimeout, jmxMetricsConfig, configuration, emptyMap())).editSpec().editKafka().withListeners(new GenericKafkaListenerBuilder().withName("plain").withPort(9092).withType(KafkaListenerType.INTERNAL).withTls(false).withAuth(new KafkaListenerAuthenticationOAuthBuilder().withClientId("my-client-id").withValidIssuerUri("http://valid-issuer").withIntrospectionEndpointUri("http://introspection").withNewClientSecret().withSecretName("my-secret-secret").withKey("my-secret-key").endClientSecret().build()).build()).endKafka().endSpec().build();
    KafkaCluster kc = KafkaCluster.fromCrd(Reconciliation.DUMMY_RECONCILIATION, kafkaAssembly, VERSIONS);
    StatefulSet sts = kc.generateStatefulSet(true, null, null, null);
    Container cont = sts.getSpec().getTemplate().getSpec().getContainers().get(0);
    assertThat(cont.getEnv().stream().filter(var -> "STRIMZI_PLAIN_9092_OAUTH_CLIENT_SECRET".equals(var.getName())).findFirst().orElseThrow().getValueFrom().getSecretKeyRef().getName(), is("my-secret-secret"));
    assertThat(cont.getEnv().stream().filter(var -> "STRIMZI_PLAIN_9092_OAUTH_CLIENT_SECRET".equals(var.getName())).findFirst().orElseThrow().getValueFrom().getSecretKeyRef().getKey(), is("my-secret-key"));
}

Example 4 with KafkaListenerAuthenticationOAuthBuilder

use of io.strimzi.api.kafka.model.listener.KafkaListenerAuthenticationOAuthBuilder in project strimzi by strimzi.

the class KafkaClusterOAuthValidationTest method testOAuthValidationWithGroupsClaim.

@ParallelTest
public void testOAuthValidationWithGroupsClaim() {
    assertThrows(InvalidResourceException.class, () -> {
        KafkaListenerAuthenticationOAuth auth = new KafkaListenerAuthenticationOAuthBuilder().withValidIssuerUri("http://valid-issuer").withJwksEndpointUri("http://jwks-endpoint").withGroupsClaim("['bad'.'query']").build();
        ListenersValidator.validate(Reconciliation.DUMMY_RECONCILIATION, 3, getListeners(auth));
    });
}

Example 5 with KafkaListenerAuthenticationOAuthBuilder

use of io.strimzi.api.kafka.model.listener.KafkaListenerAuthenticationOAuthBuilder in project strimzi by strimzi.

the class KafkaClusterOAuthValidationTest method testOAuthValidationRefreshSecondsSetWithExpirySecondsNotSet.

@ParallelTest
public void testOAuthValidationRefreshSecondsSetWithExpirySecondsNotSet() {
    assertThrows(InvalidResourceException.class, () -> {
        KafkaListenerAuthenticationOAuth auth = new KafkaListenerAuthenticationOAuthBuilder().withValidIssuerUri("http://valid-issuer").withJwksEndpointUri("http://jwks-endpoint").withJwksRefreshSeconds(333).build();
        ListenersValidator.validate(Reconciliation.DUMMY_RECONCILIATION, 3, getListeners(auth));
    });
}