Repository navigation
Step-up E2E: OIDC social-login setPassword fallback (Keycloak harness) — follow-up to #75 #90
Description
Context
Follow-up from #75 (WebAuthn step-up / SUF-02). That PR covers the client handling and the E2E acceptance cases that run against the standard Playwright harness (chromium-step-up, profiles local,playwright-test,step-up,step-up-e2e). One acceptance case from the expanded criteria is intentionally deferred here because it needs infrastructure the current E2E harness does not have.
Remaining acceptance case
From #75's acceptance criteria (E2E, step-up enabled):
Social-login (OIDC) account with no passkey →
setPasswordis governed byallowInitialPasswordSetWithoutStepUp, not a permanent401.
The mechanism is verified server-side: StepUpService.canSatisfyStepUp returns false for an account that can never satisfy WEBAUTHN step-up (no passkey), so setPassword falls back to allowInitialPasswordSetWithoutStepUp (library #365). What is missing is the browser E2E: sign in with an OIDC provider, then add a password, and confirm it is governed by the fallback rather than returning a permanent 401.
Why it is separate
It needs the Keycloak stack (docker-compose-keycloak.yml + keycloak/realm) running, an app server on a combined docker-keycloak,step-up profile (different datasource and OAuth config than the local E2E server), and an OIDC redirect-login flow in Playwright. That is effectively a new E2E project and CI job, larger than the rest of #75 combined, so it is better as its own PR.
Scope
- A
chromium-step-up-oidc(or similar) Playwright project that brings up Keycloak and runs the app ondocker-keycloak,playwright-test,step-up. - One spec: OIDC login (no passkey) →
POST /user/setPasswordis governed byallowInitialPasswordSetWithoutStepUp(403 when false, succeeds when true), not a permanent 401. - A CI job mirroring the existing
playwright-testsjob with the Keycloak service.
Also worth exercising here (noted in #75's owner comment): OIDC login now stamps FACTOR_AUTHORIZATION_CODE, so a freshly-logged-in OIDC user can enroll a first passkey.
Activity
test: assert passkey-registration notification email via Mailpit (#75)
feat: handle WebAuthn step-up (SUF-02) on sensitive operations (#75) (#…
create-issue-branch commentedon Aug 24, 2026
Branch issue-90-Step-up-E2E-OIDC-social-login-setPassword-fallback-Keycloak-harness-—-follow-up-to-#75 created!
devondragon commentedon Aug 24, 2026
PR ready for review: #93
Adds the deferred OIDC
setPasswordfallback E2E: a newchromium-step-up-oidcPlaywright project (globalSetup-managed Keycloak), a spec covering bothallowInitialPasswordSetWithoutStepUpbranches (403 when false / success when true, not a permanent 401) plus first-passkey enrollment after OIDC login, and aplaywright-tests-oidcCI job. Verified locally against a real Keycloak. The PR closes this issue on merge.ci: run OIDC step-up E2E job only on main pushes (#90)
test: extract shared WebAuthn E2E helpers and harden Keycloak startup
test: OIDC social-login setPassword step-up fallback E2E (#90) (#93)
devondragon commentedon Aug 24, 2026
Work Complete — PR Merged
PR: test: OIDC social-login setPassword step-up fallback E2E (#90)
Merged into:
main(squash,44e9cda)Branch:
feature/90-step-up-oidc-setpassword-e2e(deleted)Summary of changes
chromium-step-up-oidcPlaywright project with a globalSetup/globalTeardown-managed dev-mode Keycloak, proving a passkey-less OIDC account'sPOST /user/setPasswordis governed byallowInitialPasswordSetWithoutStepUp(403 when false, 200 when true), not a permanent 401.FACTOR_AUTHORIZATION_CODEsatisfies the enrollment gate).playwright-tests-oidcCI job (MariaDB + Mailpit + Keycloak), gated to pushes onmain.playwright/src/utils/webauthn.ts(de-duplicating the step-up/mfa/oidc specs), andstartKeycloaknow removes its container if readiness times out.Files changed
playwright/tests/step-up/step-up-oidc.spec.ts(new spec)playwright/src/utils/keycloak.ts(new Keycloak lifecycle)playwright/src/utils/webauthn.ts(new shared helpers)playwright/global-setup.ts/global-teardown.ts(new)playwright/playwright.config.ts(new project + hooks).github/workflows/tests.yml(new OIDC CI job)docs/TESTING.md,docs/AUTHENTICATION.md(run commands + coverage notes)