From b625e980a616db7fe9a0a17a41bfa9bb5894dae7 Mon Sep 17 00:00:00 2001 From: Steve Hawkins Date: Fri, 29 May 2026 09:54:22 -0400 Subject: [PATCH] fix: allowing the kubernetes jwt test to pass on openshift closes: #49445 Signed-off-by: Steve Hawkins --- .../testsuite/integration/KeycloakKubernetesJwtTest.java | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/operator/src/test/java/org/keycloak/operator/testsuite/integration/KeycloakKubernetesJwtTest.java b/operator/src/test/java/org/keycloak/operator/testsuite/integration/KeycloakKubernetesJwtTest.java index 1505168a17e4..3ac73f3a2fe5 100644 --- a/operator/src/test/java/org/keycloak/operator/testsuite/integration/KeycloakKubernetesJwtTest.java +++ b/operator/src/test/java/org/keycloak/operator/testsuite/integration/KeycloakKubernetesJwtTest.java @@ -37,6 +37,7 @@ import io.fabric8.kubernetes.api.model.PodSpec; import io.fabric8.kubernetes.api.model.PodTemplateSpec; import io.fabric8.kubernetes.client.LocalPortForward; +import io.fabric8.kubernetes.client.utils.Serialization; import io.quarkus.logging.Log; import io.quarkus.test.junit.QuarkusTest; import org.awaitility.Awaitility; @@ -120,7 +121,9 @@ public void testSignedJWTs() throws IOException { IdentityProviderRepresentation idp = new IdentityProviderRepresentation(); idp.setAlias("kubernetes"); idp.setProviderId("kubernetes"); - idp.getConfig().put("issuer", "https://kubernetes.default.svc.cluster.local"); + String oicdConfig = k8sclient.raw("/.well-known/openid-configuration"); + String issuer = (String) Serialization.unmarshal(oicdConfig, Map.class).get("issuer"); + idp.getConfig().put("issuer", issuer); keycloak.realm("test").identityProviders().create(idp).close(); } @@ -146,6 +149,7 @@ private void assertSignedJWT(Keycloak kc) { url, "-H", "Content-Type: application/x-www-form-urlencoded", "--data-urlencode", "grant_type=client_credentials", + "--data-urlencode", "client_id=kubernetes-client", // the token may not contain the client "--data-urlencode", "client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer", "--data-urlencode", "client_assertion=" + token };