Add OIDC authentication to integration tests

[lubomir]

🤖 This was posted automatically by an AI agent.

Add OIDC authentication to integration tests

Deploys Dex (OIDC provider) and an in-memory LDAP server (ldaptor) alongside CTS
in the EaaS pipeline and exercises the full mod_auth_openidc → load_openidc_user
→ get_user_info → query_ldap_groups → has_role auth stack end-to-end.

Pipeline changes (.tekton/integration-test-eaas.yaml)

• New deploy-openldap task (runs in parallel with deploy-dex after
  provision-environment): creates a ConfigMap with an in-memory LDAP server
  script (using ldaptor/Twisted) defining two users (builder / readonly) and
  two groups (cts-builders / readonly-users), then deploys the server on port
  1389.
• New deploy-dex task (parallel with deploy-openldap): generates a
  self-signed CA and TLS certificate for Dex, creates a ConfigMap with a Dex
  config using the password connector and a static OAuth2 client
  (cts-integration), then deploys Dex on port 5556.
• Updated deploy-cts: runAfter now includes deploy-openldap and
  deploy-dex. The cts-config ConfigMap sets AUTH_BACKEND=oidc_or_kerberos,
  AUTH_OPENIDC_USERINFO_URI, AUTH_LDAP_SERVER (pointing to openldap:1389),
  AUTH_LDAP_GROUPS, ADMINS, and ALLOWED_BUILDERS. The httpd.conf gains
  mod_auth_openidc directives (OIDCProviderMetadataURL,
  OIDCOAuthVerifyJwksUri, OIDCClientID/Secret, OIDCRemoteUserClaim,
  OIDCCABundlePath) and a <RequireAny> block that allows unauthenticated
  GET requests while requiring a valid Bearer token for writes.
• Updated run-tests: installs requests alongside pytest, retrieves the
  Dex CA certificate, and passes AUTH_BACKEND=oidc_or_kerberos and
  DEX_URL=https://dex:5556 to the test runner so the auth tests are not skipped.

Test changes (tests/test_integration_api.py)

• AuthHTTPClient: HTTPClient subclass that injects Authorization: Bearer
  on every request.
• _get_oidc_token(): obtains a real access token from Dex via the ROPC grant;
  used by auth_http_client_builder and auth_http_client_readonly fixtures.
• write_http_client fixture: returns an AuthHTTPClient (as builder) when
  OIDC is active, or a plain HTTPClient in noauth mode. Existing workflow tests
  that perform writes are updated to use this fixture.
• Four new test functions (skipped when AUTH_BACKEND is not openidc or
  oidc_or_kerberos):
  • test_auth_unauthenticated_write_returns_401 – bare POST → 401
  • test_auth_builder_can_post_compose – builder Bearer token → 200
  • test_auth_unauthorized_user_returns_403 – readonly Bearer token → 403
  • test_auth_get_endpoints_accessible_without_token – unauthenticated GET → 200

All pre-existing tests continue to pass unchanged under AUTH_BACKEND=noauth.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.69%. Comparing base (7c45869) to head (84d022b).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #75      +/-   ##
==========================================
+ Coverage   81.95%   83.69%   +1.74%     
==========================================
  Files          13       13              
  Lines        1302     1325      +23     
==========================================
+ Hits         1067     1109      +42     
+ Misses        235      216      -19     

Flag	Coverage Δ
unit-tests	83.69% <ø> (+1.74%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.