Plan: Multi-Backend Identity Integration Tests

POST /application/o/token/
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id=craig-cases&client_secret=REPLACE_ME_AFTER_INSTALL&scope=openid

- model: authentik_providers_oauth2.oauth2provider
  id: provider-<svc>
  identifiers:
    name: <svc>
  attrs:
    client_type: confidential
    client_id: <svc>
    client_secret: <placeholder_service_secret>
    redirect_uris: []
    authentication_flow: !Find [authentik_flows.flow, [slug, default-source-authentication]]
    authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
    invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
    signing_key: !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]]
    property_mappings:
      - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]]
      - !Find [authentik_providers_oauth2.scopemapping, [scope_name, email]]
      - !Find [authentik_providers_oauth2.scopemapping, [scope_name, profile]]
    include_claims_in_id_token: true
    sub_mode: hashed_user_id

- model: authentik_core.application
  identifiers:
    slug: <svc>
  attrs:
    name: <svc>
    provider: !KeyOf provider-<svc>
    policy_engine_mode: any

*** xref:plans/idp-multibackend-tests.adoc[Authentik + Dex Multi-Backend Identity Integration Tests]

client_type: confidential
client_id: <svc>
client_secret: <model.placeholder_service_secret>
redirect_uris: []
authentication_flow: !Find [authentik_flows.flow, [slug, default-source-authentication]]
authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
signing_key: !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]]
property_mappings:
  - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]]
  - !Find [authentik_providers_oauth2.scopemapping, [scope_name, email]]
  - !Find [authentik_providers_oauth2.scopemapping, [scope_name, profile]]
include_claims_in_id_token: true
sub_mode: hashed_user_id

#[test]
fn each_provider_has_redirect_uris_empty_array() {
    let s = render(&IdentityModel::devstack_defaults()).unwrap();
    let occurrences = s.matches("redirect_uris: []").count();
    assert_eq!(occurrences, CRAIG_SERVICES.len(),
        "expected `redirect_uris: []` once per service, got {occurrences}");
}

#[test]
fn each_provider_references_default_flows() {
    let s = render(&IdentityModel::devstack_defaults()).unwrap();
    for slug in &[
        "default-source-authentication",
        "default-provider-authorization-implicit-consent",
        "default-provider-invalidation-flow",
    ] {
        let needle = format!("!Find [authentik_flows.flow, [slug, {slug}]]");
        let occurrences = s.matches(&needle).count();
        assert_eq!(occurrences, CRAIG_SERVICES.len(),
            "expected {slug} reference once per service, got {occurrences}");
    }
}

#[test]
fn each_provider_references_signing_key_and_scope_mappings() {
    let s = render(&IdentityModel::devstack_defaults()).unwrap();
    let cert = "!Find [authentik_crypto.certificatekeypair, [name, \"authentik Self-signed Certificate\"]]";
    assert_eq!(s.matches(cert).count(), CRAIG_SERVICES.len());
    for scope in &["openid", "email", "profile"] {
        let needle = format!("!Find [authentik_providers_oauth2.scopemapping, [scope_name, {scope}]]");
        assert_eq!(s.matches(&needle).count(), CRAIG_SERVICES.len());
    }
}

#[test]
fn each_provider_has_sub_mode_hashed_user_id() {
    let s = render(&IdentityModel::devstack_defaults()).unwrap();
    assert_eq!(s.matches("sub_mode: hashed_user_id").count(), CRAIG_SERVICES.len());
}

  # ── Multi-backend identity validation (Plan E followup) ────────────
  # Opt-in profile bringing up Authentik + Dex for IdP-neutral integration
  # tests. Activated via `cargo xtask dev multibackend-up` (not docker
  # compose directly — per coding-conventions.md).
  #
  # Validated images (verified at registry 2026-05-12):
  # - ghcr.io/goauthentik/server:2026.2.2
  # - ghcr.io/dexidp/dex:v2.45.1
  # Authentik image is Debian-based (no Alpine variant upstream); accepted
  # as controlled exception to coding-conventions.md § Container Runtime
  # since we don't build the image.

  redis:
    image: redis:7-alpine
    ports:
      - "${CRAIG_PORT_REDIS_6379:-6379}:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 10
    profiles:
      - identity-multibackend

  authentik-server:
    image: ghcr.io/goauthentik/server:2026.2.2
    command: server
    environment:
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_POSTGRESQL__HOST: postgres
      AUTHENTIK_POSTGRESQL__USER: craig
      AUTHENTIK_POSTGRESQL__PASSWORD: craig
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_SECRET_KEY: devstack-only-secret-not-for-production
      AUTHENTIK_BOOTSTRAP_PASSWORD: password
      AUTHENTIK_BOOTSTRAP_EMAIL: admin@craig.example.com
      AUTHENTIK_DISABLE_UPDATE_CHECK: "true"
      AUTHENTIK_DISABLE_STARTUP_ANALYTICS: "true"
      AUTHENTIK_AVATARS: none
    volumes:
      - ./devstack/authentik/blueprints:/blueprints/custom:ro
    ports:
      - "${CRAIG_PORT_AUTHENTIK_9000:-9000}:9000"
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "ak", "healthcheck"]
      interval: 10s
      timeout: 5s
      retries: 30
      start_period: 90s
    profiles:
      - identity-multibackend

  authentik-worker:
    image: ghcr.io/goauthentik/server:2026.2.2
    command: worker
    environment:
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_POSTGRESQL__HOST: postgres
      AUTHENTIK_POSTGRESQL__USER: craig
      AUTHENTIK_POSTGRESQL__PASSWORD: craig
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_SECRET_KEY: devstack-only-secret-not-for-production
      AUTHENTIK_BOOTSTRAP_PASSWORD: password
      AUTHENTIK_BOOTSTRAP_EMAIL: admin@craig.example.com
      AUTHENTIK_DISABLE_UPDATE_CHECK: "true"
      AUTHENTIK_DISABLE_STARTUP_ANALYTICS: "true"
      AUTHENTIK_AVATARS: none
    volumes:
      - ./devstack/authentik/blueprints:/blueprints/custom:ro
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "ak", "healthcheck"]
      interval: 10s
      timeout: 5s
      retries: 30
      start_period: 90s
    profiles:
      - identity-multibackend

  dex:
    image: ghcr.io/dexidp/dex:v2.45.1
    command: ["dex", "serve", "/etc/dex/config.yaml"]
    volumes:
      - ./devstack/dex/config.yaml:/etc/dex/config.yaml:ro
    ports:
      - "${CRAIG_PORT_DEX_5556:-5556}:5556"
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://localhost:5556/healthz"]
      interval: 5s
      timeout: 3s
      retries: 10
    profiles:
      - identity-multibackend

("redis", 6379, 6379),
("authentik", 9000, 9000),
("authentik", 9443, 9443),
("dex", 5556, 5556),

/// Bring up the `identity-multibackend` profile (Authentik + Dex + Redis dep).
/// Opt-in IdP integration backends — see plans/idp-multibackend-tests.adoc.
MultibackendUp,
/// Tear down the `identity-multibackend` profile + delete its volumes.
MultibackendDown,

DevCommand::MultibackendUp => multibackend_up(),
DevCommand::MultibackendDown => multibackend_down(),

fn multibackend_up() -> Result<()> {
    println!("==> Bringing up identity-multibackend profile (Authentik + Dex + Redis)...");
    println!("    Authentik first boot takes ~90s while it applies blueprints.");
    docker::compose(&["--profile", "identity-multibackend", "up", "-d"])?;
    println!("==> Multibackend profile up. Verify with:");
    println!("    cargo nextest run -p craig-test-lib --test identity_multibackend");
    Ok(())
}

fn multibackend_down() -> Result<()> {
    println!("==> Tearing down identity-multibackend profile + its volumes...");
    docker::compose(&["--profile", "identity-multibackend", "down", "-v"])?;
    Ok(())
}

# CRAIG identity bundle for Dex — devstack-only, NOT for production.
issuer: http://localhost:5556
storage:
  type: memory
web:
  http: 0.0.0.0:5556
logger:
  level: info
oauth2:
  skipApprovalScreen: true

staticClients:
  - id: craig-rules
    name: "CRAIG service: craig-rules"
    public: false
    secret: REPLACE_ME_AFTER_INSTALL
    redirectURIs: []
  - id: craig-cases
    name: "CRAIG service: craig-cases"
    public: false
    secret: REPLACE_ME_AFTER_INSTALL
    redirectURIs: []
  - id: craig-placement
    name: "CRAIG service: craig-placement"
    public: false
    secret: REPLACE_ME_AFTER_INSTALL
    redirectURIs: []
  - id: craig-exchange
    name: "CRAIG service: craig-exchange"
    public: false
    secret: REPLACE_ME_AFTER_INSTALL
    redirectURIs: []
  - id: craig-financial
    name: "CRAIG service: craig-financial"
    public: false
    secret: REPLACE_ME_AFTER_INSTALL
    redirectURIs: []
  - id: craig-reporting
    name: "CRAIG service: craig-reporting"
    public: false
    secret: REPLACE_ME_AFTER_INSTALL
    redirectURIs: []
  - id: craig-security
    name: "CRAIG service: craig-security"
    public: false
    secret: REPLACE_ME_AFTER_INSTALL
    redirectURIs: []
  - id: craig-intake
    name: "CRAIG service: craig-intake"
    public: false
    secret: REPLACE_ME_AFTER_INSTALL
    redirectURIs: []
  - id: craig-web
    name: "CRAIG service: craig-web"
    public: false
    secret: REPLACE_ME_AFTER_INSTALL
    redirectURIs: []
  - id: craig-ui
    name: "CRAIG Web UI"
    public: true
    redirectURIs:
      - http://localhost:8080/auth/callback
  - id: craig-api
    name: "CRAIG CLI / integration tests (ROPC)"
    public: true
    redirectURIs: []

enablePasswordDB: false

cargo xtask dev multibackend-up
cargo nextest run -p craig-test-lib --test identity_multibackend
cargo xtask dev multibackend-down

* *authentik* — IaC generator shipped (`cargo xtask identity render --backend authentik`). Verified end-to-end against Authentik 2026.2.2: rendered blueprint imports cleanly, OIDC discovery + JWKS + `client_credentials` grant for service-account principals all pass. Activate via `cargo xtask dev multibackend-up`; run `cargo nextest run -p craig-test-lib --test identity_multibackend`.
* *dex* — IaC generator shipped (`cargo xtask identity render --backend dex`). Verified end-to-end against Dex 2.45.1 via the same integration test.

=== feat(xtask, devstack, craig-test-lib): Authentik + Dex multi-backend identity integration tests (DATE)

Plan E follow-up. Closes the gap between Plan E's "IdP-neutral" architectural claim and what was actually verified. Three backends now exercised end-to-end:

* Keycloak (existing devstack default + 203/203 E2E)
* Authentik (new — full client_credentials grant via the rendered blueprint)
* Dex (new — full client_credentials grant via staticClients)

Devstack gains opt-in `identity-multibackend` profile bringing up Authentik (server + worker + Redis dep) and Dex. Pre-rendered configs at `devstack/{authentik,dex}/` are committed. Profile activation via the new `cargo xtask dev multibackend-up` / `multibackend-down` subcommands.

`cargo xtask identity render --backend authentik` extended: each `oauth2provider` now references Authentik's pre-shipped flows + signing-key + scope-mappings via `!Find` lookups + carries `redirect_uris: []` + `sub_mode: hashed_user_id`. Closes the renderer limitation Plan E Step 13 documented. 4 new inline renderer unit tests pin each new attribute.

Two integration tests at `crates/craig-test-lib/tests/identity_multibackend.rs` verify discovery + JWKS + `client_credentials` grant per backend. Tests skip cleanly when the profile isn't running.

Default `cargo xtask dev start` is unchanged — profile stays opt-in.

`docs/modules/ROOT/pages/idp-integration.adoc` claim flipped: "community-validated" → "verified end-to-end".