Repository navigation
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
gtema
force-pushed
the
oauth2
branch
2 times, most recently
from
October 15, 2026 06:49
105234d to
3be8795
Compare
|
🦢 Load Test Results Goose Attack ReportPlan Overview
Request Metrics
Response Time Metrics
Status Code Metrics
Transaction Metrics
Scenario Metrics
Error Metrics
|
|
🧪 Tempest Identity Compatibility Results (advisory, non-blocking) rust Failed test IDs |
The OP login page offers the enabled identity providers of its domain, but no test drove that path end to end. Add a Keycloak-backed test binary to tests/federation, run by the skaffold verify step next to the existing Keycloak tests. Browser tests (Selenium Firefox, real Keycloak): - authorize: login page IdP button, Keycloak sign-in, consent, authorization code, token. Checks nonce, the federated `amr` and that `sub` is the user the mapping created in the OP domain. - authorize with an unmapped upstream user: the login page shows the upstream failure, no redirect to the RP, no user is provisioned. - device flow: same round trip through /device and the device federated callback. Protocol tests against the callback (no browser): - wrong `state` is rejected with 400 and no redirect. - upstream `error=access_denied` shows the failure, and the spent state cannot be answered again. - a callback from a browser that did not start the flow is rejected. Each test creates its own domain, IdP, mapping and OP client. The RP redirect URI is https://rp.invalid/cb because public clients may only use https or http://localhost, which a remote browser cannot serve; the test reads the target from Firefox's error page. Assisted-by: Claude <noreply@anthropic.com> Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
#[tokio::test] gives each test its own runtime, but the shared keystone_utils client pools connections process-wide. In parallel runs a pooled connection from a finished test's runtime was reused and the request failed with 'runtime dropped the dispatch task'. Use a thread-local client so connections never cross runtimes. Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The OP login page offers the enabled identity providers of its domain,
but no test drove that path end to end. Add a Keycloak-backed test
binary to tests/federation, run by the skaffold verify step next to
the existing Keycloak tests.
Browser tests (Selenium Firefox, real Keycloak):
authorization code, token. Checks nonce, the federated
amrandthat
subis the user the mapping created in the OP domain.upstream failure, no redirect to the RP, no user is provisioned.
federated callback.
Protocol tests against the callback (no browser):
stateis rejected with 400 and no redirect.error=access_deniedshows the failure, and the spentstate cannot be answered again.
Each test creates its own domain, IdP, mapping and OP client. The RP
redirect URI is https://rp.invalid/cb because public clients may only
use https or http://localhost, which a remote browser cannot serve; the
test reads the target from Firefox's error page.
Assisted-by: Claude noreply@anthropic.com
Signed-off-by: Artem Goncharov artem.goncharov@gmail.com