Conformance suite: pdp_auth_type=api_key is unusable with discovery, and blocks the invalid-credentials 401 module

Open
  • Is something wrong?
#641 2 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
68/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
java
Domain
testing-qa

Research direction

Start by locating AddApiKeyAuthenticationParametersToAuthzenApiRequest, GetPDPDynamicServerConfiguration, GetPDPStaticServerConfiguration, and CorruptAuthzenClientCredentials in the conformance suite. Run the six AuthZEN plans with discovery plus api_key and the invalid-credentials module under api_key. Done means the discovery combination preserves the configured key and the invalid-credentials module reaches its 401 evaluation without requiring an unused client object.

Written by the indexing model from the issue text.

Description

certification

Two of the pdp_auth_type=api_key paths in the AuthZEN conformance modules do not work. Both are in the conformance suite rather than the specification; filing here since #640 is also a harness report.

api_key cannot be combined with pdp_server_metadata=discovery.

AddApiKeyAuthenticationParametersToAuthzenApiRequest reads the key from the pdp environment object:

String secret = env.getString("pdp", "api_key");

but GetPDPDynamicServerConfiguration replaces that object wholesale with the fetched metadata document:

JsonObject serverConfig = JsonParser.parseString(jsonString).getAsJsonObject();
env.putObject("pdp", serverConfig);

so the pdp.api_key supplied in the test configuration is gone by the time the first authenticated request is built. GetPDPStaticServerConfiguration puts config.pdp into the environment instead, which keeps it. Every (discovery, api_key) run therefore fails at the first authenticated condition with:

'PDP API Key' field is missing from the 'AuthZEN' section in the test configuration

Observed on all 148 applicable modules across the six AuthZEN plans. The same two variant parameters are advertised as independent, so the combination is selectable in the UI.

authzen-pdp-evaluation-invalid-credentials-returns-401 cannot run under api_key.

The module declares itself applicable to it:

@VariantNotApplicable(parameter = PDPAuthType.class, values = {"none", "mtls"})

but CorruptAuthzenClientCredentials requires a client object:

@PreEnvironment(required = {"client", "pdp"})

and @VariantSetup(parameter = PDPAuthType.class, value = "api_key") never creates one, so the module ends with:

couldn't find required object in environment before evaluation: client

The condition body already handles either credential, corrupting client.client_secret and pdp.api_key independently and erroring only when neither is present, so requiring client up front looks stricter than intended.

Found running the six AuthZEN plans against an OPA-based PDP. With static + api_key the rest of the suite is unaffected: 145 of 149 modules pass, the remainder being this one and #640.

Dominant language
TypeScript
Stars
170
Forks
46
Avg merge
18h 5m
Merged PRs (30d)
43

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from openid/authzen

All issues in openid/authzen

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.