Add full-flow behat + playwright coverage for GSSP service name - #95
Open
kayjoosten wants to merge 7 commits into
Open
Add full-flow behat + playwright coverage for GSSP service name#95kayjoosten wants to merge 7 commits into
kayjoosten wants to merge 7 commits into
Conversation
…mdui:UIInfo Adds a behat feature that exercises the cross-repo service name flow: the SP includes an mdui:UIInfo/mdui:DisplayName extension in the SFO AuthnRequest, the Stepup-Gateway (with feature flag enable_service_name_from_saml_authnrequest enabled) forwards it in the proxy AuthnRequest to the GSSP, and the demo GSSP displays the service name on its authentication page. The devssp test SP does not support the mdui:UIInfo extension yet, so a patched sp.php with an mdui_displayname form field is mounted over the one in the devssp container, pending upstream inclusion in OpenConext-devssp.
Playwright suite exercises the mdui:UIInfo service-name flow end to end against the running devconf stack, complementing the existing behat scenario. Also adds a missing "on the GSSP registration page" assertion step alongside the existing authentication-page one.
mdui_displayname support is now a real patch against OpenConext-devssp's sp.php instead of a full-file mount, so the 711-line local copy and its docker-compose override are no longer needed here. Not pushed yet: this depends on the devssp image being rebuilt with that patch, so the test/behat run against the current :latest image will not have the mdui field until then.
johanib
reviewed
Jul 28, 2026
| # ./start-dev-env.sh gateway:<Stepup-Gateway checkout> demogssp:<Stepup-gssp-example checkout> | ||
| # docker compose exec behat ./vendor/bin/behat --config config/behat.yml features/gssp_service_name.feature | ||
| @SKIP | ||
| Feature: The GSSP shows the name of the service the user is authenticating for |
Contributor
There was a problem hiding this comment.
What i expect to see here: All 3 of the LoginService::singleSignOn methods should be triggered from here to see if the gateway applies (or discards????) the mdui information.
Contributor
There was a problem hiding this comment.
stepup/tests/behat/features/sfo.feature stepup/tests/behat/features/sfo_gssp_fallback.feature
Gateway has three independent LoginService::singleSignOn implementations that each read the mdui:UIInfo extension behind the same feature flag: GatewayBundle (plain SSO), SecondFactorOnlyBundle, and SamlStepupProviderBundle (the latter two already exercised by the existing SFO scenarios). Per review feedback on this PR, add a third scenario that drives the plain SSO flow (second-sp -> default-sp) so a regression in that specific copy would be caught even with the SFO scenarios passing. Also fixes lib/middleware.ts's pushServiceName(), which was sending service_name as a bare string. Middleware/Gateway expect a locale => name map (SamlEntity::fromConfiguration coerces anything that isn't an array to []), so the value was silently discarded rather than actually overriding the AuthnRequest's mdui:DisplayName. Adds seed-test-identity.sh: seeds a fully vetted Demo GSSP identity directly via Middleware's command API (the same mechanism FeatureContext's "has a vetted" step uses), so testing this flow manually no longer requires the registration UI, RA app, or any second-factor hardware.
VerifyYubikeyOtpType's field is named yubikeyInput with block prefix gateway_verify_yubikey (see Stepup-Gateway's Form/Type/VerifyYubikeyOtpType.php), not the gateway_verify_yubikey_otp_otp / gateway_verify_yubikey_otp_submit ids these helpers were still using. Every scenario that verifies a Yubikey second factor or logs into the RA app was failing on "Form field ... gateway_verify_yubikey_otp_otp not found" as a result.
- The feature flag is append_service_name_to_authnrequest, not enable_service_name_from_saml_authnrequest (that name never existed in Stepup-Gateway's config; only the FeatureConfiguration method uses that wording). - OpenConext-devssp's mdui_displayname field merged upstream, so it's no longer a pending dependency for lifting @Skip -- only Gateway#624 is. - The documented `./vendor/bin/behat --config config/behat.yml features/gssp_service_name.feature` invocation doesn't actually work: the suite's default tag filter excludes @Skip, so it reports "No specifications found" unless --tags='~@wip' is passed to override it. - append_service_name_to_authnrequest defaults to false and devconf has no parameters override enabling it, so "already the case in the devconf parameters" was incorrect -- documented the manual step needed instead. - Documented seed-test-identity.sh as an alternative to the Behat-bootstrap dependency in the Playwright README.
Not meant to be pushed to GitHub -- the Behat coverage (gssp_service_name.feature) is the test suite of record for this feature. Local node_modules/test-results/ screenshots were already gitignored and never tracked.
kayjoosten
force-pushed
the
feature/gssp-service-name-fullflow-behat
branch
from
August 3, 2026 13:06
9781c80 to
d86182b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
stepup/ssp/sp.php(mounted over the stock devssp SP) withmdui:UIInfo/mdui:DisplayNameextension support, since the stock SP image doesn't support itgssp_service_name.feature: SP → Gateway → GSSP, asserting the service name from the AuthnRequest shows on the GSSP page@SKIPuntilStepup-Gateway#624merges and releases in the test imageHow to test locally against the in-flight feature branches
Or run the playwright suite in
stepup/tests/playwright/(see its README).Note: this exercises Gateway → GSSP directly via the SSP test SP, not the full production path through EngineBlock (EngineBlock#2034 handles that leg separately).