Skip to content

test(e2e): add comprehensive e2e tests for rh-identity authentication #1045

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
major wants to merge 5 commits into
base: main
Choose a base branch
from
+469 −0
Open

test(e2e): add comprehensive e2e tests for rh-identity authentication #1045

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
8b73a61
test(e2e): add rh-identity auth configuration files
major Jan 22, 2026
6fa1523
test(e2e): add step definitions for rh-identity header handling
major Jan 22, 2026
baffd2e
test(e2e): add RHIdentity feature tag handling
major Jan 22, 2026
a2c7264
test(e2e): add rh-identity authentication test scenarios
major Jan 22, 2026
686d53b
fix(e2e): remove extra quotes from substring assertions in rh-identit…
major Jan 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions tests/e2e/configuration/library-mode/lightspeed-stack-auth-rh-identity.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
name: Lightspeed Core Service (LCS) - RH Identity Auth
service:
host: 0.0.0.0
port: 8080
auth_enabled: true
workers: 1
color_log: true
access_log: true
llama_stack:
use_as_library_client: true
library_client_config_path: run.yaml
user_data_collection:
feedback_enabled: true
feedback_storage: "/tmp/data/feedback"
transcripts_enabled: true
transcripts_storage: "/tmp/data/transcripts"
conversation_cache:
type: "sqlite"
sqlite:
db_path: "/tmp/data/conversation-cache.db"
authentication:
module: "rh-identity"
rh_identity_config:
required_entitlements: ["rhel"]
25 changes: 25 additions & 0 deletions tests/e2e/configuration/server-mode/lightspeed-stack-auth-rh-identity.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
name: Lightspeed Core Service (LCS) - RH Identity Auth
service:
host: 0.0.0.0
port: 8080
auth_enabled: true
workers: 1
color_log: true
access_log: true
llama_stack:
use_as_library_client: false
url: http://llama-stack:8321
api_key: xyzzy
user_data_collection:
feedback_enabled: true
feedback_storage: "/tmp/data/feedback"
transcripts_enabled: true
transcripts_storage: "/tmp/data/transcripts"
conversation_cache:
type: "sqlite"
sqlite:
db_path: "/tmp/data/conversation-cache.db"
authentication:
module: "rh-identity"
rh_identity_config:
required_entitlements: ["rhel"]
293 changes: 293 additions & 0 deletions tests/e2e/features/authorized_rh_identity.feature
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,293 @@
@RHIdentity
Feature: Authorized endpoint API tests for the rh-identity authentication module

Background:
Given The service is started locally
And REST API service prefix is /v1

Scenario: Request fails when x-rh-identity header is missing
Given The system is in default state
When I access endpoint "authorized" using HTTP POST method
"""
{"placeholder":"abc"}
"""
Then The status code of the response is 401
And The body of the response is the following
"""
{"detail": "Missing x-rh-identity header"}
"""

Scenario: Request fails when x-rh-identity header has invalid base64
Given The system is in default state
And I set the x-rh-identity header to raw value "not-valid-base64!!!"
When I access endpoint "authorized" using HTTP POST method
"""
{"placeholder":"abc"}
"""
Then The status code of the response is 400
And The body of the response contains Invalid base64 encoding

Scenario: Request fails when x-rh-identity header has invalid JSON
Given The system is in default state
And I set the x-rh-identity header with base64 encoded value "{not valid json"
When I access endpoint "authorized" using HTTP POST method
"""
{"placeholder":"abc"}
"""
Then The status code of the response is 400
And The body of the response contains Invalid JSON

Scenario: Request fails when identity field is missing
Given The system is in default state
And I set the x-rh-identity header with JSON
"""
{"entitlements": {"rhel": {"is_entitled": true}}}
"""
When I access endpoint "authorized" using HTTP POST method
"""
{"placeholder":"abc"}
"""
Then The status code of the response is 400
And The body of the response contains "Missing 'identity' field"

Scenario: Request fails when identity field is null
Given The system is in default state
And I set the x-rh-identity header with JSON
"""
{"identity": null, "entitlements": {"rhel": {"is_entitled": true}}}
"""
When I access endpoint "authorized" using HTTP POST method
"""
{"placeholder":"abc"}
"""
Then The status code of the response is 400
And The body of the response contains "Missing 'identity' field"

Scenario: Request fails when identity type field is missing
Given The system is in default state
And I set the x-rh-identity header with JSON
"""
{"identity": {"org_id": "321"}, "entitlements": {"rhel": {"is_entitled": true}}}
"""
When I access endpoint "authorized" using HTTP POST method
"""
{"placeholder":"abc"}
"""
Then The status code of the response is 400
And The body of the response contains "Missing identity 'type' field"

Scenario: Request fails with unsupported identity type
Given The system is in default state
And I set the x-rh-identity header with JSON
"""
{"identity": {"type": "Unknown", "org_id": "123"}}
"""
When I access endpoint "authorized" using HTTP POST method
"""
{"placeholder":"abc"}
"""
Then The status code of the response is 400
And The body of the response contains Unsupported identity type

Scenario: Request succeeds with valid User identity and required entitlements
Given The system is in default state
And I set the x-rh-identity header with valid User identity
| field | value |
| user_id | test-user-123 |
| username | testuser@redhat.com |
| org_id | 321 |
| entitlements | rhel |
When I access endpoint "authorized" using HTTP POST method
"""
{"placeholder":"abc"}
"""
Then The status code of the response is 200

Scenario: Request succeeds with valid System identity and required entitlements
Given The system is in default state
And I set the x-rh-identity header with valid System identity
| field | value |
| cn | c87dcb4c-8af1-40dd-878e-60c744edddd0 |
| account_number | 456 |
| org_id | 654 |
| entitlements | rhel |
When I access endpoint "authorized" using HTTP POST method
"""
{"placeholder":"abc"}
"""
Then The status code of the response is 200

Scenario: Request fails when required entitlement is missing
Given The system is in default state
And I set the x-rh-identity header with valid User identity
| field | value |
| user_id | test-user-123 |
| username | testuser@redhat.com |
| org_id | 321 |
| entitlements | ansible |
When I access endpoint "authorized" using HTTP POST method
"""
{"placeholder":"abc"}
"""
Then The status code of the response is 403
And The body of the response contains Missing required entitlement

Scenario: Request fails when user has no entitlements
Given The system is in default state
And I set the x-rh-identity header with JSON
"""
{
"identity": {
"type": "User",
"org_id": "321",
"user": {"user_id": "test-user-123", "username": "testuser@redhat.com"}
},
"entitlements": {}
}
"""
When I access endpoint "authorized" using HTTP POST method
"""
{"placeholder":"abc"}
"""
Then The status code of the response is 403
And The body of the response contains Missing required entitlement

Scenario: Request fails when entitlement exists but is_entitled is false
Given The system is in default state
And I set the x-rh-identity header with JSON
"""
{
"identity": {
"type": "User",
"org_id": "321",
"user": {"user_id": "test-user-123", "username": "testuser@redhat.com"}
},
"entitlements": {"rhel": {"is_entitled": false, "is_trial": true}}
}
"""
When I access endpoint "authorized" using HTTP POST method
"""
{"placeholder":"abc"}
"""
Then The status code of the response is 403
And The body of the response contains Missing required entitlement

Scenario: Request fails when User identity is missing user field
Given The system is in default state
And I set the x-rh-identity header with JSON
"""
{
"identity": {
"type": "User",
"org_id": "321"
},
"entitlements": {"rhel": {"is_entitled": true}}
}
"""
When I access endpoint "authorized" using HTTP POST method
"""
{"placeholder":"abc"}
"""
Then The status code of the response is 400
And The body of the response contains "Missing 'user' field for User type"

Scenario: Request fails when User identity is missing user_id
Given The system is in default state
And I set the x-rh-identity header with JSON
"""
{
"identity": {
"type": "User",
"org_id": "321",
"user": {"username": "testuser@redhat.com"}
},
"entitlements": {"rhel": {"is_entitled": true}}
}
"""
When I access endpoint "authorized" using HTTP POST method
"""
{"placeholder":"abc"}
"""
Then The status code of the response is 400
And The body of the response contains "Missing 'user_id' in user data"

Scenario: Request fails when User identity is missing username
Given The system is in default state
And I set the x-rh-identity header with JSON
"""
{
"identity": {
"type": "User",
"org_id": "321",
"user": {"user_id": "test-user-123"}
},
"entitlements": {"rhel": {"is_entitled": true}}
}
"""
When I access endpoint "authorized" using HTTP POST method
"""
{"placeholder":"abc"}
"""
Then The status code of the response is 400
And The body of the response contains "Missing 'username' in user data"

Scenario: Request fails when System identity is missing system field
Given The system is in default state
And I set the x-rh-identity header with JSON
"""
{
"identity": {
"type": "System",
"account_number": "456",
"org_id": "654"
},
"entitlements": {"rhel": {"is_entitled": true}}
}
"""
When I access endpoint "authorized" using HTTP POST method
"""
{"placeholder":"abc"}
"""
Then The status code of the response is 400
And The body of the response contains "Missing 'system' field for System type"

Scenario: Request fails when System identity is missing cn
Given The system is in default state
And I set the x-rh-identity header with JSON
"""
{
"identity": {
"type": "System",
"account_number": "456",
"org_id": "654",
"system": {}
},
"entitlements": {"rhel": {"is_entitled": true}}
}
"""
When I access endpoint "authorized" using HTTP POST method
"""
{"placeholder":"abc"}
"""
Then The status code of the response is 400
And The body of the response contains "Missing 'cn' in system data"

Scenario: Request fails when System identity is missing account_number
Given The system is in default state
And I set the x-rh-identity header with JSON
"""
{
"identity": {
"type": "System",
"org_id": "654",
"system": {"cn": "c87dcb4c-8af1-40dd-878e-60c744edddd0"}
},
"entitlements": {"rhel": {"is_entitled": true}}
}
"""
When I access endpoint "authorized" using HTTP POST method
"""
{"placeholder":"abc"}
"""
Then The status code of the response is 400
And The body of the response contains "Missing 'account_number' for System type"
14 changes: 14 additions & 0 deletions tests/e2e/features/environment.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -251,6 +251,15 @@ def before_feature(context: Context, feature: Feature) -> None:
switch_config(context.feature_config)
restart_container("lightspeed-stack")

if "RHIdentity" in feature.tags:
mode_dir = "library-mode" if context.is_library_mode else "server-mode"
context.feature_config = (
f"tests/e2e/configuration/{mode_dir}/lightspeed-stack-auth-rh-identity.yaml"
)
context.default_config_backup = create_config_backup("lightspeed-stack.yaml")
switch_config(context.feature_config)
restart_container("lightspeed-stack")

if "Feedback" in feature.tags:
context.hostname = os.getenv("E2E_LSC_HOSTNAME", "localhost")
context.port = os.getenv("E2E_LSC_PORT", "8080")
Expand All @@ -273,6 +282,11 @@ def after_feature(context: Context, feature: Feature) -> None:
restart_container("lightspeed-stack")
remove_config_backup(context.default_config_backup)

if "RHIdentity" in feature.tags:
switch_config(context.default_config_backup)
restart_container("lightspeed-stack")
remove_config_backup(context.default_config_backup)

if "Feedback" in feature.tags:
for conversation_id in context.feedback_conversations:
url = f"http://{context.hostname}:{context.port}/v1/conversations/{conversation_id}"
Expand Down
Loading
Loading