apache / apache/polaris

KeyCloak integration tests failing on some OSX Dev machines

Open
#2,501 10 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
2.1k
Forks
522
Avg merge
1d 22h
Merged PRs (30d)
137

Description

### Describe the bug

When attempting to verify the 1.10 release I ran into an issue trying to run the KeycloakFileIT suite.

```
./gradlew :polaris-runtime-service:intTest --tests "RestCatalogKeycloakFileIT.testDropTableWithPurge"
```

For example would give a cryptic error about the quarkusTestPort being not set correctly. No other errors or warnings were surfaced.

Walking through with a debugger, the containers were starting correctly but the attempt to create roles in the Keycloack container was failing with a 403.

```
HttpResponseProxy{HTTP/1.1 403 Forbidden [Cache-Control: no-store, Pragma: no-cache, content-length: 64, Content-Type: application/json, Referrer-Policy: no-referrer, Strict-Transport-Security: max-age=31536000; includeSubDomains, X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN] ResponseEntityProxy{[Content-Type: application/json,Content-Length: 64,Chunked: false]}}
```

The Docker instance on my OSX seemed to have started correctly and in debug mode, I attempted to hit the URI being used by the test suite and got the following site back

Image

Which I don't think should be happening since we are in dev mode ... but seems to anyway.

Any other usages of the AdminClient are also failing with 403's

Image

### To Reproduce

_No response_

### Actual Behavior

_No response_

### Expected Behavior

_No response_

### Additional context

_No response_

### System information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by running ./gradlew :polaris-runtime-service:intTest --tests "RestCatalogKeycloakFileIT.testDropTableWithPurge" and inspect the KeycloakFileIT suite, the Keycloak container, and AdminClient role-creation path. Compare the failing OSX behavior with the expected dev-mode endpoint; done means the integration test runs successfully and AdminClient operations no longer return 403.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, java
Domain
authentication, devops, testing
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.