More flexibility in keystore related tests, Make keycloak to notify which keystore types it supports, Support for BCFKS

Closes #14964

crypto/default/src/test/java/org/keycloak/crypto/def/test/DefaultKeyStoreTypesTest.java

@@ -0,0 +1,41 @@
+package org.keycloak.crypto.def.test;
+
+import java.util.Set;
+import java.util.stream.Collectors;
+
+import org.hamcrest.Matchers;
+import org.junit.Assert;
+import org.junit.ClassRule;
+import org.junit.Test;
+import org.keycloak.common.crypto.CryptoIntegration;
+import org.keycloak.common.util.KeystoreUtil;
+import org.keycloak.rule.CryptoInitRule;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class DefaultKeyStoreTypesTest {
+
+    @ClassRule
+    public static CryptoInitRule cryptoInitRule = new CryptoInitRule();
+
+    @Test
+    public void testKeystoreFormats() {
+        Set<KeystoreUtil.KeystoreFormat> supportedKeystoreFormats = CryptoIntegration.getProvider().getSupportedKeyStoreTypes().collect(Collectors.toSet());
+        Assert.assertThat(supportedKeystoreFormats, Matchers.containsInAnyOrder(
+                KeystoreUtil.KeystoreFormat.JKS,
+                KeystoreUtil.KeystoreFormat.PKCS12,
+                KeystoreUtil.KeystoreFormat.BCFKS));
+    }
+
+    @Test
+    public void testDefaultKeystoreType() {
+        Assert.assertEquals("PKCS12", KeystoreUtil.getKeystoreType("PKCS12", "some/foo.jks", "JKS"));
+        Assert.assertEquals("PKCS12", KeystoreUtil.getKeystoreType("PKCS12", "some/foo.pkcs12", "JKS"));
+        Assert.assertEquals("PKCS12", KeystoreUtil.getKeystoreType("PKCS12", "some/foo.bcfks", "JKS"));
+        Assert.assertEquals("JKS", KeystoreUtil.getKeystoreType(null, "some/foo.jks", "JKS"));
+        Assert.assertEquals("PKCS12", KeystoreUtil.getKeystoreType(null, "some/foo.p12", "JKS"));
+        Assert.assertEquals("BCFKS", KeystoreUtil.getKeystoreType(null, "some/foo.bcfks", "JKS"));
+        Assert.assertEquals("JKS", KeystoreUtil.getKeystoreType(null, "some/foo.bcfksl", "JKS"));
+    }
+}

crypto/elytron/pom.xml

@@ -66,6 +66,11 @@
             <artifactId>junit</artifactId>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>org.hamcrest</groupId>
+            <artifactId>hamcrest</artifactId>
+            <scope>test</scope>
+        </dependency>
 
     </dependencies>
 

crypto/elytron/src/test/java/org/keycloak/crypto/elytron/test/ElytronKeyStoreTypesTest.java

@@ -0,0 +1,50 @@
+/*
+ * Copyright 2022 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package org.keycloak.crypto.elytron.test;
+
+import java.util.Set;
+import java.util.stream.Collectors;
+
+import org.hamcrest.Matchers;
+import org.junit.Assert;
+import org.junit.ClassRule;
+import org.junit.Test;
+import org.keycloak.common.crypto.CryptoIntegration;
+import org.keycloak.common.util.KeystoreUtil;
+import org.keycloak.rule.CryptoInitRule;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class ElytronKeyStoreTypesTest {
+
+    @ClassRule
+    public static CryptoInitRule cryptoInitRule = new CryptoInitRule();
+
+    // No BCFKS keystore type supported for elytron
+    @Test
+    public void testKeystoreFormats() {
+        Set<KeystoreUtil.KeystoreFormat> supportedKeystoreFormats = CryptoIntegration.getProvider().getSupportedKeyStoreTypes().collect(Collectors.toSet());
+        Assert.assertThat(supportedKeystoreFormats, Matchers.containsInAnyOrder(
+                KeystoreUtil.KeystoreFormat.JKS,
+                KeystoreUtil.KeystoreFormat.PKCS12
+        ));
+    }
+}

crypto/fips1402/src/test/java/org/keycloak/crypto/fips/test/FIPS1402KeystoreTypesTest.java

@@ -0,0 +1,49 @@
+package org.keycloak.crypto.fips.test;
+
+import java.util.Set;
+import java.util.stream.Collectors;
+
+import org.bouncycastle.crypto.CryptoServicesRegistrar;
+import org.hamcrest.Matchers;
+import org.junit.Assert;
+import org.junit.Assume;
+import org.junit.Before;
+import org.junit.ClassRule;
+import org.junit.Test;
+import org.keycloak.common.crypto.CryptoIntegration;
+import org.keycloak.common.util.Environment;
+import org.keycloak.common.util.KeystoreUtil;
+import org.keycloak.rule.CryptoInitRule;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class FIPS1402KeystoreTypesTest {
+
+    @ClassRule
+    public static CryptoInitRule cryptoInitRule = new CryptoInitRule();
+
+    @Before
+    public void before() {
+        // Run this test just if java is in FIPS mode
+        Assume.assumeTrue("Java is not in FIPS mode. Skipping the test.", Environment.isJavaInFipsMode());
+    }
+
+    @Test
+    public void testKeystoreFormatsInNonApprovedMode() {
+        Assume.assumeFalse(CryptoServicesRegistrar.isInApprovedOnlyMode());
+        Set<KeystoreUtil.KeystoreFormat> supportedKeystoreFormats = CryptoIntegration.getProvider().getSupportedKeyStoreTypes().collect(Collectors.toSet());
+        Assert.assertThat(supportedKeystoreFormats, Matchers.containsInAnyOrder(
+                KeystoreUtil.KeystoreFormat.PKCS12,
+                KeystoreUtil.KeystoreFormat.BCFKS));
+    }
+
+    // BCFIPS approved mode supports only BCFKS. No JKS nor PKCS12 support for keystores
+    @Test
+    public void testKeystoreFormatsInApprovedMode() {
+        Assume.assumeTrue(CryptoServicesRegistrar.isInApprovedOnlyMode());
+        Set<KeystoreUtil.KeystoreFormat> supportedKeystoreFormats = CryptoIntegration.getProvider().getSupportedKeyStoreTypes().collect(Collectors.toSet());
+        Assert.assertThat(supportedKeystoreFormats, Matchers.containsInAnyOrder(
+                KeystoreUtil.KeystoreFormat.BCFKS));
+    }
+}