Skip to content

E2E / staging-OIDC stack (0.6.0 B5)

A Dockerized stack that exercises the Dashboard's real OIDC auth path — a mock OIDC IdP + kneo-serv + the Dashboard in oidc mode. The eval stack (../docker-compose.yml) is static/dev only and never touches the login/RBAC wiring; this one does, so a broken auth path can't ship green. It's also the base for the Playwright role-matrix, live-SSE, and negative-auth suites and the release staging-OIDC gate.

Run the boot-smoke

examples/e2e/smoke.sh

Boots the stack, drives a full Authorization-Code + PKCE login, and asserts /api/me resolves the operator with the role the IdP asserted — then tears down. Exits non-zero on failure. This is the scaffolding-first proof that the fixture works end-to-end; the browser suites layer on top.

Pieces

  • docker-compose.yml — ghcr.io/navikt/mock-oauth2-server + pinned kneo-serv + the dash in oidc mode. (Scaffolding pins by tag for readability and uses the released dash image to validate the fixture; the real release gate builds the cut's image and pins by digest — promotion equivalence.)
  • mock-oidc.json — the IdP config. A non-interactive token callback (matched on grant_type=authorization_code, the param present at the token endpoint — not scope, which is only on /authorize) injects the claims: sub, a verified email, and roles:["dash-operator"]. The dash KNEO_DASH_OIDC_ROLE_MAP maps dash-operator → operator.
  • mock-oidc-matrix.json — the same, but three issuers (dash-admin / dash-operator / dash-viewer), each emitting a different roles claim. This backs the Playwright OIDC role-matrix suite (frontend/e2e/oidc/roles.spec.ts, config playwright.oidc.config.ts, CI job e2e-oidc): the suite runs the mock via docker run + three BFFs in oidc mode (one per issuer) all on localhost, so it sidesteps the dual-network issuer gotcha below — the issuer the BFF discovers is the same origin the browser is redirected to, no --resolve needed. (The docker-compose stack keeps the container-network topology on purpose, to exercise the digest-pinned promotion-equivalence path.)

Notes / gotchas (learned standing this up)

  • Callback route is /api/callback — not /api/auth/callback. (The prod example had the wrong path; fixed alongside this.)
  • Dual-network issuer. The token's iss and the discovery endpoints must be reachable from both the dash container (network: mock-oidc:8080) and the browser (host). The smoke uses curl --resolve mock-oidc:8080:127.0.0.1 so the host resolves the compose hostname to the published port — same issuer string works both ways. A browser Playwright run needs the equivalent (a host alias, or Playwright inside the compose network).
  • mock-OIDC has no healthcheck — the image is distroless (no shell/wget). The dash contacts the IdP only at login, so depends_on: service_started is sufficient.

Files