Embedded outpost (#1193)

* api: allow API requests as managed outpost's account when using secret_key

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* root: load secret key from env

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* outposts: make listener IP configurable

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* outpost/proxy: run outpost in background and pass requests conditionally

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* outpost: unify branding to embedded

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* web/admin: fix embedded outpost not being editable

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* web: fix mismatched host detection

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* tests/e2e: fix LDAP test not including user for embedded outpost

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* tests/e2e: fix user matching

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* api: add tests for secret_key auth

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* root: load environment variables using github.com/Netflix/go-env

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

tests/e2e/test_provider_ldap.py

@@ -19,6 +19,7 @@ from ldap3.core.exceptions import LDAPInvalidCredentialsResult
 from authentik.core.models import Application, Group, User
 from authentik.events.models import Event, EventAction
 from authentik.flows.models import Flow
+from authentik.outposts.managed import MANAGED_OUTPOST
 from authentik.outposts.models import Outpost, OutpostType
 from authentik.providers.ldap.models import LDAPProvider
 from tests.e2e.utils import (
@@ -193,6 +194,9 @@ class TestProviderLDAP(SeleniumTestCase):
                 },
             )
         )
+
+        embedded_account = Outpost.objects.filter(managed=MANAGED_OUTPOST).first().user
+
         _connection.search(
             "ou=users,dc=ldap,dc=goauthentik,dc=io",
             "(objectClass=user)",
@@ -232,6 +236,31 @@ class TestProviderLDAP(SeleniumTestCase):
                     },
                     "type": "searchResEntry",
                 },
+                {
+                    "dn": f"cn={embedded_account.username},ou=users,dc=ldap,dc=goauthentik,dc=io",
+                    "attributes": {
+                        "cn": [embedded_account.username],
+                        "uid": [embedded_account.uid],
+                        "name": [""],
+                        "displayName": [""],
+                        "mail": [""],
+                        "objectClass": [
+                            "user",
+                            "organizationalPerson",
+                            "goauthentik.io/ldap/user",
+                        ],
+                        "uidNumber": [str(2000 + embedded_account.pk)],
+                        "gidNumber": [str(2000 + embedded_account.pk)],
+                        "memberOf": [],
+                        "accountStatus": ["true"],
+                        "superuser": ["false"],
+                        "goauthentik.io/ldap/active": ["true"],
+                        "goauthentik.io/ldap/superuser": ["false"],
+                        "goauthentik.io/user/override-ips": ["true"],
+                        "goauthentik.io/user/service-account": ["true"],
+                    },
+                    "type": "searchResEntry",
+                },
                 {
                     "dn": f"cn={USER().username},ou=users,dc=ldap,dc=goauthentik,dc=io",
                     "attributes": {

tests/e2e/test_source_saml.py

@@ -164,6 +164,7 @@ class TestSourceSAML(SeleniumTestCase):
 
         self.assert_user(
             User.objects.exclude(username="akadmin")
+            .exclude(username__startswith="ak-outpost")
             .exclude(pk=get_anonymous_user().pk)
             .first()
         )
@@ -249,6 +250,7 @@ class TestSourceSAML(SeleniumTestCase):
 
         self.assert_user(
             User.objects.exclude(username="akadmin")
+            .exclude(username__startswith="ak-outpost")
             .exclude(pk=get_anonymous_user().pk)
             .first()
         )
@@ -321,6 +323,7 @@ class TestSourceSAML(SeleniumTestCase):
 
         self.assert_user(
             User.objects.exclude(username="akadmin")
+            .exclude(username__startswith="ak-outpost")
             .exclude(pk=get_anonymous_user().pk)
             .first()
         )

tests/e2e/utils.py

@@ -48,6 +48,7 @@ class SeleniumTestCase(StaticLiveServerTestCase):
 
     def setUp(self):
         super().setUp()
+        self.maxDiff = None
         self.wait_timeout = 60
         self.driver = self._get_driver()
         self.driver.maximize_window()