mirror of
https://github.com/turnstonelabs/turnstone.git
synced 2026-08-12 23:12:23 -06:00
Patrick Buckley
3e88c54751
Manual (non-CI) harnesses that exercise the real oauth_obo mint path against a live IdP, kept for future validation of the feature: - entra_e2e.py: real Entra tenant, one interactive sign-in, drives get_obo_access_token_classified -> _obo_mint_entra (E1-E7) - keycloak_e2e.py + .sh: ephemeral Keycloak, fully headless, drives the rfc8693 leg (refresh grant -> token exchange) - entra_spike.py: raw-OAuth wire probe (pre-implementation reference) - entra_setup.sh: creates the Entra spike app registrations - .env.example template; real creds stay in a gitignored .env Both legs pass E1-E7 (mint + aud, cache hit, single-credential->multi- audience, rotation write-back, force_refresh, unconsented->credential survives, flush->re-mint). Not wired into CI. Refs #551.
20 lines
1.0 KiB
Bash
20 lines
1.0 KiB
Bash
# Entra config for the Entra e2e / spike harnesses. Copy to `.env` (gitignored)
|
|
# and fill in from your tenant. `entra_setup.sh setup` creates the app
|
|
# registrations and writes a populated `.env` for you.
|
|
#
|
|
# cp scripts/obo-e2e/.env.example scripts/obo-e2e/.env
|
|
# # then edit, or run: ./scripts/obo-e2e/entra_setup.sh setup
|
|
|
|
export ENTRA_TENANT_ID=<tenant-guid-or-domain>
|
|
export ENTRA_CLIENT_ID=<turnstone-spike-app-client-id>
|
|
export ENTRA_CLIENT_SECRET=<client-secret>
|
|
export SPIKE_AUDIENCE_A=api://<resource-app-a-guid> # a consented resource
|
|
export SPIKE_AUDIENCE_B=api://<resource-app-b-guid> # a second consented resource
|
|
export SPIKE_AUDIENCE_UNCONSENTED=api://<resource-app-c-guid> # NOT granted (negative case)
|
|
export SPIKE_RUN_OBO=1
|
|
# export SPIKE_PORT=8765 # redirect-listener port (default 8765)
|
|
# export SPIKE_CALLBACK_FILE=/tmp/obo_cb.txt # remote-browser mode: paste the redirect URL here
|
|
|
|
# The Keycloak / OSS-path harness needs no config — keycloak_e2e.sh sets
|
|
# everything and stands up an ephemeral container.
|