[DevOps] SSO 서버 Mocking 가이드: OAuth2/OIDC 테스트 환경 구축

┌──────┐     1. 로그인     ┌──────────┐
│ 사용자 │ ──────────────> │   IdP    │
└──┬───┘                  │(Keycloak)│
   │                      └────┬─────┘
   │  2. 토큰 발급              │
   │ <─────────────────────────┘
   │
   │  3. 토큰으로 접근
   ├──────────────────> [서비스 A]
   ├──────────────────> [서비스 B]
   └──────────────────> [서비스 C]

┌──────┐                    ┌──────────┐                    ┌──────────┐
│Client│                    │  AuthZ   │                    │ Resource │
│(App) │                    │  Server  │                    │  Server  │
└──┬───┘                    └────┬─────┘                    └────┬─────┘
   │  1. /authorize              │                               │
   │────────────────────────────>│                               │
   │                             │  2. 사용자 인증                 │
   │                             │  (로그인 페이지)                │
   │  3. Authorization Code      │                               │
   │<────────────────────────────│                               │
   │                             │                               │
   │  4. POST /token             │                               │
   │    (code + client_secret)   │                               │
   │────────────────────────────>│                               │
   │                             │                               │
   │  5. Access Token + ID Token │                               │
   │<────────────────────────────│                               │
   │                             │                               │
   │  6. API 호출 (Bearer Token)  │                               │
   │─────────────────────────────┼──────────────────────────────>│
   │                             │                               │
   │  7. 리소스 응답              │                               │
   │<────────────────────────────┼───────────────────────────────│

Header.Payload.Signature

Header:   {"alg": "RS256", "typ": "JWT", "kid": "key-id-1"}
Payload:  {"sub": "user123", "iss": "https://idp.example.com",
           "aud": "my-client", "exp": 1710000000, "iat": 1709996400}
Signature: RS256(base64(header) + "." + base64(payload), privateKey)

┌─────────────────────────────────────────────────────┐
│               SSO Mocking 전략                       │
├─────────────────────────────────────────────────────┤
│                                                     │
│  경량 Mock          │  중량 Mock          │  코드 레벨  │
│  ──────────         │  ──────────         │  ────────  │
│  mock-oauth2-server │  Keycloak           │  @WithMock │
│  WireMock OIDC      │  Testcontainers     │  mockMvc   │
│  oauth2-mock-server │                     │  jose JWT  │
│                     │                     │            │
│  빠른 시작           │  현실적인 테스트      │  단위 테스트  │
│  CI/CD 최적          │  통합 테스트         │  가장 빠름    │
└─────────────────────────────────────────────────────┘

version: '3.8'
services:
  mock-oauth2-server:
    image: ghcr.io/navikt/mock-oauth2-server:2.1.10
    ports:
      - "8080:8080"
    environment:
      - SERVER_PORT=8080
      - JSON_CONFIG={
          "interactiveLogin": true,
          "httpServer": "NettyWrapper",
          "tokenCallbacks": [
            {
              "issuerId": "default",
              "tokenExpiry": 3600,
              "requestMappings": [
                {
                  "requestParam": "scope",
                  "match": "openid profile",
                  "claims": {
                    "sub": "testuser",
                    "name": "Test User",
                    "email": "test@example.com",
                    "groups": ["admin", "users"]
                  }
                }
              ]
            }
          ]
        }
    healthcheck:
      test: ["CMD", "wget", "--spider", "http://localhost:8080/default/.well-known/openid-configuration"]
      interval: 5s
      timeout: 3s
      retries: 10

  my-application:
    build: .
    environment:
      - OIDC_ISSUER_URL=http://mock-oauth2-server:8080/default
      - OIDC_CLIENT_ID=my-client
      - OIDC_CLIENT_SECRET=my-secret
    depends_on:
      mock-oauth2-server:
        condition: service_healthy

# OIDC Discovery
curl http://localhost:8080/default/.well-known/openid-configuration | jq .

{
  "issuer": "http://localhost:8080/default",
  "authorization_endpoint": "http://localhost:8080/default/authorize",
  "token_endpoint": "http://localhost:8080/default/token",
  "userinfo_endpoint": "http://localhost:8080/default/userinfo",
  "jwks_uri": "http://localhost:8080/default/jwks",
  "end_session_endpoint": "http://localhost:8080/default/endsession",
  "response_types_supported": ["code", "id_token", "token"],
  "subject_types_supported": ["public"],
  "id_token_signing_alg_values_supported": ["RS256"]
}

# Client Credentials Grant
curl -X POST http://localhost:8080/default/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=my-client" \
  -d "client_secret=my-secret" \
  -d "scope=openid profile"

# Authorization Code Grant (2단계)
# 1단계: Authorization Code 획득
curl -v "http://localhost:8080/default/authorize?\
response_type=code&\
client_id=my-client&\
redirect_uri=http://localhost:3000/callback&\
scope=openid+profile&\
state=random-state"

# 2단계: Code를 Token으로 교환
curl -X POST http://localhost:8080/default/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "code=AUTHORIZATION_CODE_HERE" \
  -d "client_id=my-client" \
  -d "client_secret=my-secret" \
  -d "redirect_uri=http://localhost:3000/callback"

import no.nav.security.mock.oauth2.MockOAuth2Server

class MyServiceTest {

    companion object {
        val mockOAuth2Server = MockOAuth2Server()

        @BeforeAll
        @JvmStatic
        fun setup() {
            mockOAuth2Server.start(port = 8080)
        }

        @AfterAll
        @JvmStatic
        fun teardown() {
            mockOAuth2Server.shutdown()
        }
    }

    @Test
    fun `should validate token`() {
        // 커스텀 클레임으로 토큰 생성
        val token = mockOAuth2Server.issueToken(
            issuerId = "default",
            subject = "testuser",
            audience = "my-client",
            claims = mapOf(
                "name" to "Test User",
                "email" to "test@example.com",
                "roles" to listOf("admin")
            )
        )

        // 생성된 토큰으로 API 호출 테스트
        val response = myService.callApi(token.serialize())
        assertEquals(200, response.statusCode)
    }
}

# IdP 1: 내부 직원용
curl http://localhost:8080/internal/.well-known/openid-configuration

# IdP 2: 외부 파트너용
curl http://localhost:8080/partner/.well-known/openid-configuration

# IdP 3: 고객용
curl http://localhost:8080/customer/.well-known/openid-configuration

# RSA 개인키 생성
openssl genrsa -out private_key.pem 2048

# 공개키 추출
openssl rsa -in private_key.pem -pubout -out public_key.pem

# JWK 형식으로 변환 (Node.js 사용)
node -e "
const crypto = require('crypto');
const fs = require('fs');
const pem = fs.readFileSync('public_key.pem', 'utf8');
const key = crypto.createPublicKey(pem);
const jwk = key.export({ format: 'jwk' });
jwk.kid = 'test-key-1';
jwk.use = 'sig';
jwk.alg = 'RS256';
console.log(JSON.stringify({ keys: [jwk] }, null, 2));
" > jwks.json

{
  "request": {
    "method": "GET",
    "urlPath": "/.well-known/openid-configuration"
  },
  "response": {
    "status": 200,
    "headers": {
      "Content-Type": "application/json"
    },
    "jsonBody": {
      "issuer": "http://localhost:8080",
      "authorization_endpoint": "http://localhost:8080/authorize",
      "token_endpoint": "http://localhost:8080/token",
      "userinfo_endpoint": "http://localhost:8080/userinfo",
      "jwks_uri": "http://localhost:8080/jwks",
      "response_types_supported": ["code", "id_token", "token"],
      "subject_types_supported": ["public"],
      "id_token_signing_alg_values_supported": ["RS256"],
      "scopes_supported": ["openid", "profile", "email"],
      "token_endpoint_auth_methods_supported": ["client_secret_basic", "client_secret_post"],
      "claims_supported": ["sub", "name", "email", "iss", "aud", "exp", "iat"]
    }
  }
}

{
  "request": {
    "method": "GET",
    "urlPath": "/jwks"
  },
  "response": {
    "status": 200,
    "headers": {
      "Content-Type": "application/json"
    },
    "bodyFileName": "jwks.json"
  }
}

{
  "request": {
    "method": "POST",
    "urlPath": "/token",
    "bodyPatterns": [
      {
        "contains": "grant_type=client_credentials"
      }
    ]
  },
  "response": {
    "status": 200,
    "headers": {
      "Content-Type": "application/json"
    },
    "jsonBody": {
      "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InRlc3Qta2V5LTEifQ.eyJzdWIiOiJ0ZXN0dXNlciIsImlzcyI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MCIsImF1ZCI6Im15LWNsaWVudCIsImV4cCI6OTk5OTk5OTk5OSwiaWF0IjoxNzA5OTk2NDAwfQ.SIGNATURE",
      "token_type": "Bearer",
      "expires_in": 3600,
      "scope": "openid profile"
    }
  }
}

{
  "request": {
    "method": "GET",
    "urlPath": "/userinfo",
    "headers": {
      "Authorization": {
        "matches": "Bearer .*"
      }
    }
  },
  "response": {
    "status": 200,
    "headers": {
      "Content-Type": "application/json"
    },
    "jsonBody": {
      "sub": "testuser",
      "name": "Test User",
      "email": "test@example.com",
      "email_verified": true,
      "groups": ["admin", "developers"]
    }
  }
}

{
  "request": {
    "method": "POST",
    "urlPath": "/token"
  },
  "response": {
    "status": 200,
    "headers": {
      "Content-Type": "application/json"
    },
    "body": "{\"access_token\": \"mock-token-{{randomValue length=32 type='ALPHANUMERIC'}}\", \"token_type\": \"Bearer\", \"expires_in\": 3600, \"issued_at\": \"{{now}}\"}",
    "transformers": ["response-template"]
  }
}

testImplementation 'com.github.dasniko:testcontainers-keycloak:3.3.1'
testImplementation 'org.testcontainers:junit-jupiter:1.19.7'

import dasniko.testcontainers.keycloak.KeycloakContainer;
import org.testcontainers.junit.jupiter.Container;
import org.testcontainers.junit.jupiter.Testcontainers;

@Testcontainers
@SpringBootTest
class KeycloakIntegrationTest {

    @Container
    static KeycloakContainer keycloak = new KeycloakContainer("quay.io/keycloak/keycloak:24.0")
        .withRealmImportFile("test-realm.json");

    @DynamicPropertySource
    static void configureProperties(DynamicPropertyRegistry registry) {
        registry.add("spring.security.oauth2.resourceserver.jwt.issuer-uri",
            () -> keycloak.getAuthServerUrl() + "/realms/test-realm");
        registry.add("spring.security.oauth2.resourceserver.jwt.jwk-set-uri",
            () -> keycloak.getAuthServerUrl() + "/realms/test-realm/protocol/openid-connect/certs");
    }

    @Test
    void shouldAuthenticateWithKeycloak() {
        // Keycloak에서 토큰 발급
        String token = getAccessToken(
            keycloak.getAuthServerUrl(),
            "test-realm",
            "test-client",
            "testuser",
            "password"
        );

        // 토큰으로 API 호출
        given()
            .header("Authorization", "Bearer " + token)
            .when()
            .get("/api/protected")
            .then()
            .statusCode(200);
    }

    private String getAccessToken(String authServerUrl, String realm,
                                   String clientId, String username, String password) {
        return RestAssured
            .given()
            .contentType("application/x-www-form-urlencoded")
            .formParam("grant_type", "password")
            .formParam("client_id", clientId)
            .formParam("username", username)
            .formParam("password", password)
            .post(authServerUrl + "/realms/" + realm + "/protocol/openid-connect/token")
            .then()
            .extract()
            .path("access_token");
    }
}

{
  "realm": "test-realm",
  "enabled": true,
  "sslRequired": "none",
  "roles": {
    "realm": [{ "name": "admin" }, { "name": "user" }]
  },
  "clients": [
    {
      "clientId": "test-client",
      "enabled": true,
      "publicClient": true,
      "directAccessGrantsEnabled": true,
      "redirectUris": ["http://localhost:*"],
      "webOrigins": ["*"]
    }
  ],
  "users": [
    {
      "username": "testuser",
      "enabled": true,
      "email": "test@example.com",
      "firstName": "Test",
      "lastName": "User",
      "credentials": [
        {
          "type": "password",
          "value": "password",
          "temporary": false
        }
      ],
      "realmRoles": ["admin", "user"]
    }
  ]
}

@WebMvcTest(UserController.class)
class UserControllerTest {

    @Autowired
    private MockMvc mockMvc;

    @Test
    @WithMockUser(username = "admin", roles = {"ADMIN"})
    void adminCanAccessAdminEndpoint() throws Exception {
        mockMvc.perform(get("/api/admin/dashboard"))
            .andExpect(status().isOk());
    }

    @Test
    @WithMockUser(username = "user", roles = {"USER"})
    void userCannotAccessAdminEndpoint() throws Exception {
        mockMvc.perform(get("/api/admin/dashboard"))
            .andExpect(status().isForbidden());
    }
}

@WebMvcTest(ApiController.class)
class JwtSecurityTest {

    @Autowired
    private MockMvc mockMvc;

    @Test
    void shouldAccessWithMockJwt() throws Exception {
        mockMvc.perform(get("/api/data")
            .with(jwt()
                .jwt(j -> j
                    .subject("testuser")
                    .claim("email", "test@example.com")
                    .claim("roles", List.of("ADMIN"))
                )
                .authorities(new SimpleGrantedAuthority("ROLE_ADMIN"))
            ))
            .andExpect(status().isOk());
    }

    @Test
    void shouldAccessWithMockOidcLogin() throws Exception {
        mockMvc.perform(get("/api/profile")
            .with(oidcLogin()
                .idToken(token -> token
                    .subject("testuser")
                    .claim("name", "Test User")
                    .claim("email", "test@example.com")
                )
                .userInfoToken(userInfo -> userInfo
                    .claim("groups", List.of("admin"))
                )
            ))
            .andExpect(status().isOk());
    }
}

const jose = require('jose')
const http = require('http')

// RSA 키 페어 생성
async function createMockOIDCServer(port = 9000) {
  const { publicKey, privateKey } = await jose.generateKeyPair('RS256')
  const publicJwk = await jose.exportJWK(publicKey)
  publicJwk.kid = 'test-key-1'
  publicJwk.use = 'sig'
  publicJwk.alg = 'RS256'

  const issuer = `http://localhost:${port}`

  // JWT 토큰 생성 함수
  async function createToken(claims = {}) {
    const token = await new jose.SignJWT({
      sub: 'testuser',
      email: 'test@example.com',
      name: 'Test User',
      ...claims,
    })
      .setProtectedHeader({ alg: 'RS256', kid: 'test-key-1' })
      .setIssuer(issuer)
      .setAudience('my-client')
      .setExpirationTime('1h')
      .setIssuedAt()
      .sign(privateKey)

    return token
  }

  // HTTP 서버 생성
  const server = http.createServer(async (req, res) => {
    res.setHeader('Content-Type', 'application/json')

    if (req.url === '/.well-known/openid-configuration') {
      res.end(
        JSON.stringify({
          issuer,
          authorization_endpoint: `${issuer}/authorize`,
          token_endpoint: `${issuer}/token`,
          userinfo_endpoint: `${issuer}/userinfo`,
          jwks_uri: `${issuer}/jwks`,
        })
      )
    } else if (req.url === '/jwks') {
      res.end(JSON.stringify({ keys: [publicJwk] }))
    } else if (req.url === '/token' && req.method === 'POST') {
      const token = await createToken()
      res.end(
        JSON.stringify({
          access_token: token,
          token_type: 'Bearer',
          expires_in: 3600,
        })
      )
    } else if (req.url === '/userinfo') {
      res.end(
        JSON.stringify({
          sub: 'testuser',
          name: 'Test User',
          email: 'test@example.com',
        })
      )
    } else {
      res.statusCode = 404
      res.end(JSON.stringify({ error: 'not_found' }))
    }
  })

  server.listen(port, () => {
    console.log(`Mock OIDC Server running on ${issuer}`)
  })

  return { server, createToken }
}

// 사용법
createMockOIDCServer(9000).then(async ({ createToken }) => {
  const token = await createToken({
    roles: ['admin'],
    department: 'engineering',
  })
  console.log('Generated token:', token)
})

const express = require('express')
const jose = require('jose')

async function startMockOIDC(port = 9000) {
  const app = express()
  app.use(express.urlencoded({ extended: true }))

  const { publicKey, privateKey } = await jose.generateKeyPair('RS256')
  const publicJwk = await jose.exportJWK(publicKey)
  publicJwk.kid = 'test-key-1'
  publicJwk.use = 'sig'
  publicJwk.alg = 'RS256'

  const issuer = `http://localhost:${port}`

  // Discovery
  app.get('/.well-known/openid-configuration', (req, res) => {
    res.json({
      issuer,
      authorization_endpoint: `${issuer}/authorize`,
      token_endpoint: `${issuer}/token`,
      userinfo_endpoint: `${issuer}/userinfo`,
      jwks_uri: `${issuer}/jwks`,
      response_types_supported: ['code', 'id_token', 'token'],
      subject_types_supported: ['public'],
      id_token_signing_alg_values_supported: ['RS256'],
    })
  })

  // JWKS
  app.get('/jwks', (req, res) => {
    res.json({ keys: [publicJwk] })
  })

  // Token endpoint
  app.post('/token', async (req, res) => {
    const token = await new jose.SignJWT({
      sub: 'testuser',
      email: 'test@example.com',
      name: 'Test User',
      scope: req.body.scope || 'openid profile',
    })
      .setProtectedHeader({ alg: 'RS256', kid: 'test-key-1' })
      .setIssuer(issuer)
      .setAudience(req.body.client_id || 'my-client')
      .setExpirationTime('1h')
      .setIssuedAt()
      .sign(privateKey)

    res.json({
      access_token: token,
      id_token: token,
      token_type: 'Bearer',
      expires_in: 3600,
    })
  })

  // UserInfo
  app.get('/userinfo', (req, res) => {
    res.json({
      sub: 'testuser',
      name: 'Test User',
      email: 'test@example.com',
      email_verified: true,
    })
  })

  app.listen(port, () => console.log(`Mock OIDC on ${issuer}`))
}

startMockOIDC()

# test_oauth.py
import pytest
import json
from unittest.mock import patch, MagicMock
from authlib.jose import jwt
from authlib.jose import JsonWebKey
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.backends import default_backend

# RSA 키 페어 생성
private_key = rsa.generate_private_key(
    public_exponent=65537,
    key_size=2048,
    backend=default_backend()
)

def create_mock_token(claims=None):
    """테스트용 JWT 토큰 생성"""
    default_claims = {
        "sub": "testuser",
        "iss": "http://localhost:9000",
        "aud": "my-client",
        "exp": 9999999999,
        "iat": 1709996400,
        "name": "Test User",
        "email": "test@example.com",
    }
    if claims:
        default_claims.update(claims)

    header = {"alg": "RS256", "kid": "test-key-1"}
    token = jwt.encode(header, default_claims, private_key)
    return token.decode("utf-8")


class TestOAuthProtectedEndpoint:
    def test_authenticated_request(self, client):
        token = create_mock_token({"roles": ["admin"]})
        response = client.get(
            "/api/data",
            headers={"Authorization": f"Bearer {token}"}
        )
        assert response.status_code == 200

    def test_expired_token(self, client):
        token = create_mock_token({"exp": 1000000000})
        response = client.get(
            "/api/data",
            headers={"Authorization": f"Bearer {token}"}
        )
        assert response.status_code == 401

    def test_missing_token(self, client):
        response = client.get("/api/data")
        assert response.status_code == 401

// mock-oauth2-server에서 매우 짧은 만료 시간 설정
val token = mockOAuth2Server.issueToken(
    issuerId = "default",
    subject = "testuser",
    expiry = 1  // 1초 후 만료
)

Thread.sleep(2000)  // 2초 대기

// 만료된 토큰으로 요청 -> 401 기대
val response = client.get("/api/data") {
    header("Authorization", "Bearer ${token.serialize()}")
}
assertEquals(401, response.status.value)

{
  "request": {
    "method": "POST",
    "urlPath": "/token",
    "bodyPatterns": [{ "contains": "grant_type=refresh_token" }]
  },
  "response": {
    "status": 200,
    "headers": { "Content-Type": "application/json" },
    "jsonBody": {
      "access_token": "new-access-token",
      "refresh_token": "new-refresh-token",
      "token_type": "Bearer",
      "expires_in": 3600
    }
  }
}

{
  "request": {
    "method": "GET",
    "urlPath": "/api/protected",
    "headers": {
      "Authorization": {
        "equalTo": "Bearer invalid-token"
      }
    }
  },
  "response": {
    "status": 401,
    "headers": {
      "Content-Type": "application/json",
      "WWW-Authenticate": "Bearer error=\"invalid_token\""
    },
    "jsonBody": {
      "error": "invalid_token",
      "error_description": "The access token is invalid or has expired"
    }
  }
}

name: Integration Tests with SSO Mock
on: [push, pull_request]

jobs:
  test:
    runs-on: ubuntu-latest
    services:
      mock-oauth2:
        image: ghcr.io/navikt/mock-oauth2-server:2.1.10
        ports:
          - 8080:8080
        env:
          SERVER_PORT: '8080'
        options: >-
          --health-cmd "wget --spider http://localhost:8080/default/.well-known/openid-configuration"
          --health-interval 5s
          --health-timeout 3s
          --health-retries 10

    steps:
      - uses: actions/checkout@v4

      - name: Setup Java
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '21'

      - name: Run Tests
        run: ./gradlew test
        env:
          OIDC_ISSUER_URL: http://localhost:8080/default
          OIDC_CLIENT_ID: test-client
          OIDC_JWKS_URI: http://localhost:8080/default/jwks

      - name: Upload Test Report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: test-report
          path: build/reports/tests/

integration-test:
  stage: test
  image: gradle:8-jdk21
  services:
    - docker:dind
  variables:
    DOCKER_HOST: tcp://docker:2375
    DOCKER_TLS_CERTDIR: ''
    TESTCONTAINERS_RYUK_DISABLED: 'true'
  script:
    - gradle integrationTest
  artifacts:
    reports:
      junit: build/test-results/integrationTest/*.xml