From 286b0d15a878ade7a21020719772af8954284b21 Mon Sep 17 00:00:00 2001 From: Paul Caskey Date: Thu, 11 Oct 2018 17:41:45 -0400 Subject: [PATCH] add SP test --- test-compose/decompose.sh | 27 ++- test-compose/docker-compose.yml | 11 + .../config/shib-idp/conf/attribute-filter.xml | 9 +- .../shib-idp/conf/metadata-providers.xml | 11 +- .../shib-idp/metadata/testsp-metadata.xml | 77 +++++++ test-compose/sp/Dockerfile | 28 +++ .../sp/container_files/idp-metadata.xml | 37 +++ test-compose/sp/container_files/index.php | 2 + .../sp/container_files/shibboleth2.xml | 137 +++++++++++ test-compose/sp/container_files/ssl.conf | 218 ++++++++++++++++++ test-compose/sp/container_files/testsp.crt | 22 ++ test-compose/sp/container_files/testsp.key | 27 +++ tests/fulltest.sh | 39 ++++ tests/main.bats | 3 + tests/sptest.login | 2 + 15 files changed, 636 insertions(+), 14 deletions(-) create mode 100644 test-compose/idp/container_files/config/shib-idp/metadata/testsp-metadata.xml create mode 100644 test-compose/sp/Dockerfile create mode 100644 test-compose/sp/container_files/idp-metadata.xml create mode 100644 test-compose/sp/container_files/index.php create mode 100644 test-compose/sp/container_files/shibboleth2.xml create mode 100644 test-compose/sp/container_files/ssl.conf create mode 100644 test-compose/sp/container_files/testsp.crt create mode 100644 test-compose/sp/container_files/testsp.key create mode 100755 tests/fulltest.sh create mode 100644 tests/sptest.login diff --git a/test-compose/decompose.sh b/test-compose/decompose.sh index 3139530..2472301 100755 --- a/test-compose/decompose.sh +++ b/test-compose/decompose.sh @@ -1,6 +1,11 @@ #!/bin/bash -read -r -p "Are you sure you want to remove the test idp and data images/containers? [y/N] " response +if [ "$1" == '-y' ]; then + response="Y" +else + read -r -p "Are you sure you want to remove the test idp and data images/containers? [y/N] " response +fi + if [[ "$response" =~ ^([yY][eE][sS]|[yY])+$ ]]; then #kill, if running, and remove idp container docker ps | grep test-compose_idp &>/dev/null @@ -38,9 +43,29 @@ if [[ "$response" =~ ^([yY][eE][sS]|[yY])+$ ]]; then fi fi + #kill, if running, and remove sp container + docker ps | grep test-compose_sp &>/dev/null + if [ $? == '0' ]; then + #get container ID + export contid2=$(docker ps | grep test-compose_sp | cut -f 1 -d ' ') + docker kill ${contid2} &>/dev/null + docker rm ${contid2} &>/dev/null + else + #check if an old container is present, rm if needed + docker container ls -a | grep test-compose_sp &>/dev/null + if [ $? == '0' ]; then + #get container ID + export contid2=$(docker container ls -a | grep test-compose_sp | cut -f 1 -d ' ') + docker kill ${contid2} &>/dev/null + docker rm ${contid2} &>/dev/null + fi + fi + + #remove images docker rmi -f test-compose_idp &>/dev/null docker rmi -f test-compose_data &>/dev/null + docker rmi -f test-compose_sp &>/dev/null else echo "Terminating..." diff --git a/test-compose/docker-compose.yml b/test-compose/docker-compose.yml index ddc465b..43bc9cf 100644 --- a/test-compose/docker-compose.yml +++ b/test-compose/docker-compose.yml @@ -36,6 +36,17 @@ services: - shibidp_ldap:/var/lib/dirsrv + sp: + build: ./sp/ + expose: + - "8443" + networks: + - front + - back + ports: + - "8443:8443" + + networks: front: driver: bridge diff --git a/test-compose/idp/container_files/config/shib-idp/conf/attribute-filter.xml b/test-compose/idp/container_files/config/shib-idp/conf/attribute-filter.xml index 326dfe9..8e43db8 100644 --- a/test-compose/idp/container_files/config/shib-idp/conf/attribute-filter.xml +++ b/test-compose/idp/container_files/config/shib-idp/conf/attribute-filter.xml @@ -97,9 +97,9 @@ - - - + + + @@ -113,7 +113,6 @@ - - + diff --git a/test-compose/idp/container_files/config/shib-idp/conf/metadata-providers.xml b/test-compose/idp/container_files/config/shib-idp/conf/metadata-providers.xml index 48f06ca..6daa0ca 100644 --- a/test-compose/idp/container_files/config/shib-idp/conf/metadata-providers.xml +++ b/test-compose/idp/container_files/config/shib-idp/conf/metadata-providers.xml @@ -79,13 +79,8 @@ - - - - - + + + diff --git a/test-compose/idp/container_files/config/shib-idp/metadata/testsp-metadata.xml b/test-compose/idp/container_files/config/shib-idp/metadata/testsp-metadata.xml new file mode 100644 index 0000000..943d09b --- /dev/null +++ b/test-compose/idp/container_files/config/shib-idp/metadata/testsp-metadata.xml @@ -0,0 +1,77 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + 66388f647a9e + + CN=66388f647a9e + MIID6zCCAlOgAwIBAgIJAMCeCgmjpfr4MA0GCSqGSIb3DQEBCwUAMBcxFTATBgNV +BAMTDDY2Mzg4ZjY0N2E5ZTAeFw0xODA2MTUxMjExNDFaFw0yODA2MTIxMjExNDFa +MBcxFTATBgNVBAMTDDY2Mzg4ZjY0N2E5ZTCCAaIwDQYJKoZIhvcNAQEBBQADggGP +ADCCAYoCggGBAMneS5jhJI6hTH0lIksMea1JkouRu3schI0M/VDq4RdVla0Y1R9e +ToipLSYfGlR7X17udgSlL1HRyDjE7/IRkFt5UzAkTy/DKE0gDnmfGz3OHWPSmTzm +uPvxmSeIHwqnVAoxnRkqNQDh7uReeskXuJmoxE98hSU41FjAJ12ADPqXVGtkNQhN +78rhTcdQqWQzu8Tlho/2Zl3U3B6ANMj1gbgK20TXL1iQs1eiKBQGnT+NMBuR+fHO +HRON8v+IcrYCVAwEG4gq36xv6J37bHY1ok/MydsglOGdEobHyHVNCgA3lgPUXuMJ +S1oSR7cCcjFowi0nVSHaYwBHAyQ1g1u9g0XD+lOpLGgzGJyIgnCG8IELmaaCQ74f +gtbd8GvXktX7TkLWlAcYEBmjbrqOTxoUY8b1Wbw3AK1y9flUFpmLNPTH+WSsI70F +wb1W0wpZ+bh/0c6jNhc1vJMUY9b06nSXuqYwrxOQ2P4BPlUrkY3DnIBduOh4RFii +9kp6RPqebrd0eQIDAQABozowODAXBgNVHREEEDAOggw2NjM4OGY2NDdhOWUwHQYD +VR0OBBYEFM8IntLcC3iWk5bKQViCAXpNLOcaMA0GCSqGSIb3DQEBCwUAA4IBgQCq +vck5pcsYJAXJ/weacPjq6rjDaKYLCSCjgXYR7Dm7nOwfVnebSjbhBVOyQztU4HSB +rm2tqQwNQDFHM/YBeQYbBkKy5mGW2FO0wQX8L2pDp2SAGDsjb4FE9w5wMRJrGdCg +LpeCnMRklSxFCtBedu8eWz5nbRwYUk77VcbcNbNxx+linPHvc2Vce4a26xaoXdzC +wip2F84pxTOqlVgTpX5g5fV0lhZiNDs+HZ5quUqW9CP3xxRdwCXzulpZaN411IbV +xU4Y/J4Hi+JSS3vp3xHRGGyNxW39ljNihOO2R2T+oGwHL8Ri3iYFMXEYaVJXoIrz +IzdnpziNptcaKLKk2k2bZW+t3we2XuhFG5h6qv6lWJW7EbBQCgBLtmy2xdSklrCj +zZ8Me+OHIItA9Voe329U6HV4n676L/X5j6omS7SRlwylJ/ljqt+htL5EUwTTC8H4 +3BnUQyPT4W3Qljjyv9Weg45iMXrZd6wVYFw5JK/uT/4ST4j0PLLkK3seh91gyac= + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/test-compose/sp/Dockerfile b/test-compose/sp/Dockerfile new file mode 100644 index 0000000..d4de941 --- /dev/null +++ b/test-compose/sp/Dockerfile @@ -0,0 +1,28 @@ +FROM tier/shibboleth_sp + +LABEL author="tier-packaging@internet2.edu " \ + Vendor="TIER" \ + ImageType="Shibboleth SP" \ + ImageName=$imagename \ + ImageOS=centos7 + +RUN yum -y update; yum -y install php; mkdir -p /var/www/html/secure/ + +ADD container_files/shibboleth2.xml /etc/shibboleth/ +ADD container_files/idp-metadata.xml /etc/shibboleth/ +ADD container_files/ssl.conf /etc/httpd/conf.d/ +ADD container_files/testsp.crt /etc/pki/tls/certs/ +ADD container_files/testsp.key /etc/pki/tls/private/ +ADD container_files/index.php /var/www/html/secure/ + +RUN sed -i 's/LogFormat "/LogFormat "httpd;access_log;%{ENV}e;%{USERTOKEN}e;/g' /etc/httpd/conf/httpd.conf \ + && echo -e "\nErrorLogFormat \"httpd;error_log;%{ENV}e;%{USERTOKEN}e;[%{u}t] [%-m:%l] [pid %P:tid %T] %7F: %E: [client\ %a] %M% ,\ referer\ %{Referer}i\"" >> /etc/httpd/conf/httpd.conf \ + && sed -i 's/CustomLog "logs\/access_log"/CustomLog "\/tmp\/logpipe"/g' /etc/httpd/conf/httpd.conf \ + && sed -i 's/ErrorLog "logs\/error_log"/ErrorLog "\/tmp\/logpipe"/g' /etc/httpd/conf/httpd.conf \ + && sed -i '/UseCanonicalName/c\UseCanonicalName On' /etc/httpd/conf/httpd.conf \ + && echo -e "\nPassEnv ENV" >> /etc/httpd/conf/httpd.conf \ + && echo -e "\nPassEnv USERTOKEN" >> /etc/httpd/conf/httpd.conf + + +EXPOSE 8443 + diff --git a/test-compose/sp/container_files/idp-metadata.xml b/test-compose/sp/container_files/idp-metadata.xml new file mode 100644 index 0000000..367fa2c --- /dev/null +++ b/test-compose/sp/container_files/idp-metadata.xml @@ -0,0 +1,37 @@ + + + + example.edu + + + + + +MIIDHDCCAgSgAwIBAgIJAPEnL5jgbeVoMA0GCSqGSIb3DQEBCwUAMBoxGDAWBgNV +BAMMD2lkcC5leGFtcGxlLmVkdTAeFw0xODEwMTAyMDM1NDBaFw0yMzEwMDkyMDM1 +NDBaMBoxGDAWBgNVBAMMD2lkcC5leGFtcGxlLmVkdTCCASIwDQYJKoZIhvcNAQEB +BQADggEPADCCAQoCggEBAKwTrvQhmFX3SUNgJAhQ/YV0UX56Rt53mwbiKuH+Ez83 +7z6XRynBVsfzHfbWe0IpNKx5mIr84dfbGhQKQBEKzQuek7ihW3J6PIVZN1A3icZZ +B9i7gow902bT0ZfRG8QW49gl7pk3ASutPcO9Dq5Xc/AqWr3OSO/Pei0yBtTdzG3b +rm0u0gbj3P2tjt7BN77wIB+yjJsND3ITtP0MFXIJxLTlty8thwqQOAOAYcF+rhC5 +znnBLsRNo0E57PtzZs8i/BpEX2uPTxpEyvlU1vtyxcKUiHtK5ZjOsDEkS2rEualr ++FILYg/Oxw1gi0+mNO1a94Ft+UoLiREztq6MQt8OK98CAwEAAaNlMGMwQgYDVR0R +BDswOYIPaWRwLmV4YW1wbGUuZWR1hiZodHRwczovL2lkcC5leGFtcGxlLmVkdS9p +ZHAvc2hpYmJvbGV0aDAdBgNVHQ4EFgQU3ZJ8oHkmlgPtZuZAxnzONccPsb8wDQYJ +KoZIhvcNAQELBQADggEBAIJ4oZKSMGpF8J3qdfjLZGkc3iVbu/eiE1MD77no0oCz +nelY0CNUBuFJk1Xv+Bv0fW0cVugtMPz4xi7zv0zkpS2IVxpPZWBosuVabUD9k+V4 +iN5woJdO7e2KRGvhlWmbkmoZUvhygDe0u0vblNfLzDwFQvxHXiWG//P7SanoQrjP +dE8U21tYz+EFm6s5TvHxVhr9id8c+UacAFCpAtzUB+J8K1abx05XlKsySflkOQV9 +JbM4zOy5gXSI5dY9dGUF77g0muyC+jAhIhLSt/7v3vJgvBurrxPoeBFXOU3D+siT +VZlKtYzYjJhVqXx1vKrWEE1hkpqm+iYgZe4MvgcdswY= + + + + + + + + + + + diff --git a/test-compose/sp/container_files/index.php b/test-compose/sp/container_files/index.php new file mode 100644 index 0000000..1d3efd3 --- /dev/null +++ b/test-compose/sp/container_files/index.php @@ -0,0 +1,2 @@ + + diff --git a/test-compose/sp/container_files/shibboleth2.xml b/test-compose/sp/container_files/shibboleth2.xml new file mode 100644 index 0000000..6caa45a --- /dev/null +++ b/test-compose/sp/container_files/shibboleth2.xml @@ -0,0 +1,137 @@ + + + + + + + + + + + + + + + + + SAML2 + + + + SAML2 Local + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/test-compose/sp/container_files/ssl.conf b/test-compose/sp/container_files/ssl.conf new file mode 100644 index 0000000..19b1139 --- /dev/null +++ b/test-compose/sp/container_files/ssl.conf @@ -0,0 +1,218 @@ +# +# When we also provide SSL we have to listen to the +# the HTTPS port in addition. +# +Listen 8443 https + +## +## SSL Global Context +## +## All SSL configuration in this context applies both to +## the main server and all SSL-enabled virtual hosts. +## + +# Pass Phrase Dialog: +# Configure the pass phrase gathering process. +# The filtering dialog program (`builtin' is a internal +# terminal dialog) has to provide the pass phrase on stdout. +SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog + +# Inter-Process Session Cache: +# Configure the SSL Session Cache: First the mechanism +# to use and second the expiring timeout (in seconds). +SSLSessionCache shmcb:/run/httpd/sslcache(512000) +SSLSessionCacheTimeout 300 + +# Pseudo Random Number Generator (PRNG): +# Configure one or more sources to seed the PRNG of the +# SSL library. The seed data should be of good random quality. +# WARNING! On some platforms /dev/random blocks if not enough entropy +# is available. This means you then cannot use the /dev/random device +# because it would lead to very long connection times (as long as +# it requires to make more entropy available). But usually those +# platforms additionally provide a /dev/urandom device which doesn't +# block. So, if available, use this one instead. Read the mod_ssl User +# Manual for more details. +SSLRandomSeed startup file:/dev/urandom 256 +SSLRandomSeed connect builtin +#SSLRandomSeed startup file:/dev/random 512 +#SSLRandomSeed connect file:/dev/random 512 +#SSLRandomSeed connect file:/dev/urandom 512 + +# +# Use "SSLCryptoDevice" to enable any supported hardware +# accelerators. Use "openssl engine -v" to list supported +# engine names. NOTE: If you enable an accelerator and the +# server does not start, consult the error logs and ensure +# your accelerator is functioning properly. +# +SSLCryptoDevice builtin +#SSLCryptoDevice ubsec + +## +## SSL Virtual Host Context +## + + + +# General setup for the virtual host, inherited from global configuration +#DocumentRoot "/var/www/html" +ServerName sptest.example.edu:8443 +UseCanonicalName On + +# Use separate log files for the SSL virtual host; note that LogLevel +# is not inherited from httpd.conf. +ErrorLog logs/ssl_error_log +TransferLog logs/ssl_access_log +LogLevel warn + +# SSL Engine Switch: +# Enable/Disable SSL for this virtual host. +SSLEngine on + +# SSL Protocol support: +# List the enable protocol levels with which clients will be able to +# connect. Disable SSLv2 access by default: +SSLProtocol all -SSLv2 -SSLv3 + +# SSL Cipher Suite: +# List the ciphers that the client is permitted to negotiate. +# See the mod_ssl documentation for a complete list. +SSLCipherSuite HIGH:3DES:!aNULL:!MD5:!SEED:!IDEA + +# Speed-optimized SSL Cipher configuration: +# If speed is your main concern (on busy HTTPS servers e.g.), +# you might want to force clients to specific, performance +# optimized ciphers. In this case, prepend those ciphers +# to the SSLCipherSuite list, and enable SSLHonorCipherOrder. +# Caveat: by giving precedence to RC4-SHA and AES128-SHA +# (as in the example below), most connections will no longer +# have perfect forward secrecy - if the server's key is +# compromised, captures of past or future traffic must be +# considered compromised, too. +#SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5 +#SSLHonorCipherOrder on + +# Server Certificate: +# Point SSLCertificateFile at a PEM encoded certificate. If +# the certificate is encrypted, then you will be prompted for a +# pass phrase. Note that a kill -HUP will prompt again. A new +# certificate can be generated using the genkey(1) command. +SSLCertificateFile /etc/pki/tls/certs/testsp.crt + +# Server Private Key: +# If the key is not combined with the certificate, use this +# directive to point at the key file. Keep in mind that if +# you've both a RSA and a DSA private key you can configure +# both in parallel (to also allow the use of DSA ciphers, etc.) +SSLCertificateKeyFile /etc/pki/tls/private/testsp.key + +# Server Certificate Chain: +# Point SSLCertificateChainFile at a file containing the +# concatenation of PEM encoded CA certificates which form the +# certificate chain for the server certificate. Alternatively +# the referenced file can be the same as SSLCertificateFile +# when the CA certificates are directly appended to the server +# certificate for convinience. +#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt + +# Certificate Authority (CA): +# Set the CA certificate verification path where to find CA +# certificates for client authentication or alternatively one +# huge file containing all of them (file must be PEM encoded) +#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt + +# Client Authentication (Type): +# Client certificate verification type and depth. Types are +# none, optional, require and optional_no_ca. Depth is a +# number which specifies how deeply to verify the certificate +# issuer chain before deciding the certificate is not valid. +#SSLVerifyClient require +#SSLVerifyDepth 10 + +# Access Control: +# With SSLRequire you can do per-directory access control based +# on arbitrary complex boolean expressions containing server +# variable checks and other lookup directives. The syntax is a +# mixture between C and Perl. See the mod_ssl documentation +# for more details. +# +#SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \ +# and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \ +# and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \ +# and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \ +# and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \ +# or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/ +# + +# SSL Engine Options: +# Set various options for the SSL engine. +# o FakeBasicAuth: +# Translate the client X.509 into a Basic Authorisation. This means that +# the standard Auth/DBMAuth methods can be used for access control. The +# user name is the `one line' version of the client's X.509 certificate. +# Note that no password is obtained from the user. Every entry in the user +# file needs this password: `xxj31ZMTZzkVA'. +# o ExportCertData: +# This exports two additional environment variables: SSL_CLIENT_CERT and +# SSL_SERVER_CERT. These contain the PEM-encoded certificates of the +# server (always existing) and the client (only existing when client +# authentication is used). This can be used to import the certificates +# into CGI scripts. +# o StdEnvVars: +# This exports the standard SSL/TLS related `SSL_*' environment variables. +# Per default this exportation is switched off for performance reasons, +# because the extraction step is an expensive operation and is usually +# useless for serving static content. So one usually enables the +# exportation for CGI and SSI requests only. +# o StrictRequire: +# This denies access when "SSLRequireSSL" or "SSLRequire" applied even +# under a "Satisfy any" situation, i.e. when it applies access is denied +# and no other module can change it. +# o OptRenegotiate: +# This enables optimized SSL connection renegotiation handling when SSL +# directives are used in per-directory context. +#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire + + SSLOptions +StdEnvVars + + + SSLOptions +StdEnvVars + + +# SSL Protocol Adjustments: +# The safe and default but still SSL/TLS standard compliant shutdown +# approach is that mod_ssl sends the close notify alert but doesn't wait for +# the close notify alert from client. When you need a different shutdown +# approach you can use one of the following variables: +# o ssl-unclean-shutdown: +# This forces an unclean shutdown when the connection is closed, i.e. no +# SSL close notify alert is send or allowed to received. This violates +# the SSL/TLS standard but is needed for some brain-dead browsers. Use +# this when you receive I/O errors because of the standard approach where +# mod_ssl sends the close notify alert. +# o ssl-accurate-shutdown: +# This forces an accurate shutdown when the connection is closed, i.e. a +# SSL close notify alert is send and mod_ssl waits for the close notify +# alert of the client. This is 100% SSL/TLS standard compliant, but in +# practice often causes hanging connections with brain-dead browsers. Use +# this only for browsers where you know that their SSL implementation +# works correctly. +# Notice: Most problems of broken clients are also related to the HTTP +# keep-alive facility, so you usually additionally want to disable +# keep-alive for those clients, too. Use variable "nokeepalive" for this. +# Similarly, one has to force some clients to use HTTP/1.0 to workaround +# their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and +# "force-response-1.0" for this. +BrowserMatch "MSIE [2-5]" \ + nokeepalive ssl-unclean-shutdown \ + downgrade-1.0 force-response-1.0 + +# Per-Server Logging: +# The home of a custom SSL log file. Use this when you want a +# compact non-error SSL logfile on a virtual host basis. +CustomLog logs/ssl_request_log \ + "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" + + + diff --git a/test-compose/sp/container_files/testsp.crt b/test-compose/sp/container_files/testsp.crt new file mode 100644 index 0000000..34a135d --- /dev/null +++ b/test-compose/sp/container_files/testsp.crt @@ -0,0 +1,22 @@ +-----BEGIN CERTIFICATE----- +MIIDnTCCAoWgAwIBAgIJANYHemLHm+2hMA0GCSqGSIb3DQEBCwUAMGUxCzAJBgNV +BAYTAlVTMREwDwYDVQQIDAhNaWNoaWdhbjESMBAGA1UEBwwJQW5uIEFyYm9yMRIw +EAYDVQQKDAlJbnRlcm5ldDIxGzAZBgNVBAMMEnNwdGVzdC5leGFtcGxlLmVkdTAe +Fw0xODEwMTExNzE4MjBaFw0yMTEwMTAxNzE4MjBaMGUxCzAJBgNVBAYTAlVTMREw +DwYDVQQIDAhNaWNoaWdhbjESMBAGA1UEBwwJQW5uIEFyYm9yMRIwEAYDVQQKDAlJ +bnRlcm5ldDIxGzAZBgNVBAMMEnNwdGVzdC5leGFtcGxlLmVkdTCCASIwDQYJKoZI +hvcNAQEBBQADggEPADCCAQoCggEBALWP3/PVFC+IoP8yvLz/fAz6Kt5owWyCcGeU +e0ujIcB566JfOtnY5NDsw0H6dtok7ZXwmlXBB+pUMgmA3M292V1Uchc92uM/7NJD +gEmPfw1O4ZA6hoC2jyGtg3vbaGVvYLMJ4ItHPVdsH/MARZz47WtYeGP8fCc2dgTO +BG4I7w2vNZOS0sgFKUXpwpMEOzprF9PDY6+c7v48hQxuhwIDORIeYXKBzp1Nl0Jr +FidZjnPsdrY4NFmqawhuV9eviwBO0a+tS/7RynxKRbFKpNO1tRv1K5UmtwtopChl +CcjeHlvhbUXp3KKBe7HSffTZwTiKYKAuSNqf++b9OBMXol0XBtsCAwEAAaNQME4w +HQYDVR0OBBYEFOUsErZhx0Jdla4+bUSL5dvVl1dsMB8GA1UdIwQYMBaAFOUsErZh +x0Jdla4+bUSL5dvVl1dsMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB +AC4JrL7YNOk3G4GiIQCJK0zBwzIMSaMcpi6SdjANrdZu+1lu5dj2AOBKL9seM88o +eqw5Kb0+fZFrpVm4MKTrIs/WtHTZVIhXQiaDBvuCllwbP8+leP/YFmEbWQ+tSzau +6gU6Po+K0jpQwyNTJABbxKGR80Dkq3+Y1JKMGM+MgL32IUUr4/pAG/tb/Y0tH0uC +qa5f9MihfT1iEKI1t5VYvX6gazB9y8OogxSvfG88KXYkx4NmIzpEVjVz/kmtdTyQ +c6OmH8dk8HhShS8Wvq3djzKMuaAqOL/1jCVPdOATDz/GNBYyNT1RV9z2xpPvmPeX +ohK/aCmoHBcAGjxEZhfUJQk= +-----END CERTIFICATE----- diff --git a/test-compose/sp/container_files/testsp.key b/test-compose/sp/container_files/testsp.key new file mode 100644 index 0000000..f954c3e --- /dev/null +++ b/test-compose/sp/container_files/testsp.key @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEpQIBAAKCAQEAtY/f89UUL4ig/zK8vP98DPoq3mjBbIJwZ5R7S6MhwHnrol86 +2djk0OzDQfp22iTtlfCaVcEH6lQyCYDczb3ZXVRyFz3a4z/s0kOASY9/DU7hkDqG +gLaPIa2De9toZW9gswngi0c9V2wf8wBFnPjta1h4Y/x8JzZ2BM4EbgjvDa81k5LS +yAUpRenCkwQ7OmsX08Njr5zu/jyFDG6HAgM5Eh5hcoHOnU2XQmsWJ1mOc+x2tjg0 +WaprCG5X16+LAE7Rr61L/tHKfEpFsUqk07W1G/UrlSa3C2ikKGUJyN4eW+FtRenc +ooF7sdJ99NnBOIpgoC5I2p/75v04ExeiXRcG2wIDAQABAoIBAQCZcKAZ12gZy+QU +CHMNXvUdmoaENA/TfmE0iH2yrIknu2HydXytAupNzuotZljvfunzH8Wu11WzKbin +42m3zsxWXbmV/sZv62RfRoCyqjz7qEBkvbFSMfbAxX0rPX/6yaf1Z1GHI4upyE0v +9njeclljsP79sTHTiekvolSIEbDF5HImDuwc10V9y0Ci0OO5TylASauUyhL066IW +4R4rRBx4xs86kkt2ch399d88qZ0rNLV5+GJmenEbKjlHaejYtwLL5bYnPpo4ODsX +6mGd5ZXNsnABCOGg9kitOkroMSdGQdaL8XgPhaUjnkQOmLZ88ryCWybbKvHrvsLa +YDvXc1NRAoGBAOFbceuhK6rTtWmiPWQ0Jd8jcFnOJ1q7Cm58vBi5KhUV7omAlYFa +wZRZkrHeB+WEfxZh5/xgFqUvzIJzjOp1btxuzQUOeN2RNAzt6QlgLM3mZPNGND5+ +2/VF9cAm3apcvJNZpbeqLxf/qMaPWrw+LX+/8ijzVCsEm526wpmSWBgHAoGBAM4/ +8bXfOBHnphYTqqSBAs70vI16rKqluhywF6ZsQvEZ0WLZ9tlq024dRRRlO4oOSPXO +HaHyU20AfLAxsX7HnCdq5d6fa4b84Tyw+n19UZ/IUsjHhkrDXj3sJ7fi5Veg/ujH +hTbj1Cp36vyV3hm0f6X+lc5uyh1XCkLE9LVpHx2NAoGBAMfO52vO48O7n/5/zcTZ +g7abWlMVuMj2S6J4z+Fv00MMxgl+S5B8YmRhIvK3dPLoDjJPLnwSyiE+Byqmvwtm +gZvKVdck5L82rhrEmjko37DTlTApT8sVeXq3w9PR4fnZ7Y0MECWPK+AwWnlqwz1i +N78r9c6fKEJX/I3V+BJnsdnjAoGBAJr5eUnLfHoXsbiM9n+9YLrZMoSsVOm0tW+w +8VRfrL01RRwd41ni5xOqcqmsl1xY94GbarCxQPZ6kzZhYJl+q1sC+86Xw1ge06+i +29VHQPnqsCmlosaynjGxLPcDSojZtDB9Gx/veRCgIrXAdq6h7fhwn2gJ31zEdjVN +gQJ/Bp5RAoGABD5G0sCcb+C5n2ch3emGfS8UL0NqbhwwHdDxQ7IOIjjjgms5wUQJ +ZMmUvRJr8jzCCPD8DrHf85GAACRPoVsBDLD3oXTLcY8Frum1npH57H6Eaa/Jmuk5 +UdDJprIEgUhY47jK1O+IKtxnTQPnqotqWC5Lk4Rhnr62APxhkl9jraI= +-----END RSA PRIVATE KEY----- diff --git a/tests/fulltest.sh b/tests/fulltest.sh new file mode 100755 index 0000000..7e541a2 --- /dev/null +++ b/tests/fulltest.sh @@ -0,0 +1,39 @@ +#!/bin/bash + +pushd ../test-compose &>/dev/null +echo "Launching fresh containers..." +./decompose.sh -y &>/dev/null +./compose.sh &>/dev/null +popd &>/dev/null + +echo "Waiting 3 minutes while everything comes up..." +sleep 180 + +pushd tests &>/dev/null +rm -f lastpage.txt + +echo "Attempting full-cycle test..." +webisoget -verbose -out lastpage.txt -formfile sptest.login -url https://sptest.example.edu:8443/secure/ &>/dev/null + +cat lastpage.txt | grep kwhite@example.edu &>/dev/null +if [ $? == "0" ]; then + echo "The full-cycle test of the IdP and SP was successfull!" + echo "" + pushd ../test-compose &>/dev/null + ./decompose.sh -y &>/dev/null + popd &>/dev/null + rm -f lastpage.txt + popd &>/dev/null + exit 0 +else + echo "The full-cycle test of the IdP and SP failed." + echo "" + pushd ../test-compose &>/dev/null + #./decompose.sh -y &>/dev/null + popd &>/dev/null + rm -f lastpage.txt + popd &>/dev/null + exit 1 +fi + + diff --git a/tests/main.bats b/tests/main.bats index 6e9ee25..4fa64f1 100644 --- a/tests/main.bats +++ b/tests/main.bats @@ -50,4 +50,7 @@ load ../common ./tests/clairscan.sh ${maintainer}/${imagename}:latest } +@test "080 The IdP successfully completed a full-cycle test with an SP" { + ./tests/fulltest.sh +} diff --git a/tests/sptest.login b/tests/sptest.login new file mode 100644 index 0000000..53a2277 --- /dev/null +++ b/tests/sptest.login @@ -0,0 +1,2 @@ +name=; domain=idp.example.edu; j_username=kwhite; j_password=password; +