build.yml

# The contents of this file are subject to the terms of the Common Development and
# Distribution License (the License). You may not use this file except in compliance with the
# License.
#
# You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
# specific language governing permission and limitations under the License.
#
# When distributing Covered Software, include this CDDL Header Notice in each file and include
# the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
# Header, with the fields enclosed by brackets [] replaced by your own identifying
# information: "Portions copyright [year] [name of copyright owner]".
#
# Copyright 2021-2026 3A Systems, LLC.
name: Build

on:
  push:
    branches: [ 'sustaining/15.2.x','master','issues/**','features/**' ]
  pull_request:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
jobs:
  build-maven:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ 'ubuntu-latest' ]
        java: [ '11', '17', '21', '25', '26' ]
        include:
          - { os: 'macos-latest',   java: '11' }
          - { os: 'macos-latest',   java: '26' }
          - { os: 'windows-latest', java: '11' }
          - { os: 'windows-latest', java: '26' }
      fail-fast: false
    steps:
    - uses: actions/checkout@v6
      with:
        fetch-depth: 0
        submodules: recursive
    - name: Java ${{ matrix.Java }} (${{ matrix.os }})
      uses: actions/setup-java@v5
      with:
        java-version: ${{ matrix.java }}
        distribution: 'zulu'
    - name: Cache Maven packages
      uses: actions/cache@v5
      with:
         path: ~/.m2/repository
         key: ${{ runner.os }}-m2-repository-${{ hashFiles('**/pom.xml') }}
         restore-keys: ${{ runner.os }}-m2-repository
    - name: Set Integration Test Environment
      if: matrix.os == 'ubuntu-latest'
      run:  | 
        echo "MAVEN_PROFILE_FLAG=-P integration-test" >> $GITHUB_OUTPUT 
        echo "127.0.0.1 openam.local" | sudo tee -a /etc/hosts
      id: maven-profile-flag
    - name: Build with Maven
      env:
        MAVEN_OPTS: -Dhttps.protocols=TLSv1.2 -Dmaven.wagon.httpconnectionManager.ttlSeconds=120 -Dmaven.wagon.http.retryHandler.requestSentEnabled=true -Dmaven.wagon.http.retryHandler.count=10
      run: mvn --batch-mode --errors --update-snapshots verify --file pom.xml ${{ steps.maven-profile-flag.outputs.MAVEN_PROFILE_FLAG }}
    - name: Upload artifacts
      uses: actions/upload-artifact@v6
      with:
        name: ${{ matrix.os }}-${{ matrix.java }}
        retention-days: 5
        path:  |
          openam-distribution/openam-distribution-kit/target/*.zip
          openam-distribution/openam-distribution-ssoconfiguratortools/target/*.zip
          openam-distribution/openam-distribution-fedlet-unconfigured/target/*.zip
          openam-distribution/openam-distribution-ssoadmintools/target/*.zip
          openam-console/target/*.war
          openam-server/target/*.war
          openam-server-only/target/*.war
          openam-distribution/openam-distribution-docker/Dockerfile*
  build-docker:
    needs: build-maven
    runs-on: 'ubuntu-latest'
    services:
      registry:
        image: registry:2
        ports:
          - 5000:5000
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v8
        with:
          name: ubuntu-latest-11
      - name: Get latest release version
        shell: bash
        run:   |
          export git_version_last="$(curl -i -o - --silent https://api.github.com/repos/OpenIdentityPlatform/OpenAM/releases/latest | grep -m1 "\"name\"" | cut -d\" -f4)" ; echo "last release: $git_version_last"
          echo "release_version=$git_version_last" >> $GITHUB_ENV
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: |
            localhost:5000/${{ github.repository }}
          tags: |
            type=raw,value=latest
            type=raw,value=${{ env.release_version }}
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
        with:
          driver-opts: network=host
      - name: Prepare Dockerfile
        shell: bash
        run: sed -i -E '/^#COPY openam-(server|distribution)\//s/^#//' ./openam-distribution/openam-distribution-docker/Dockerfile
      - name: Build image
        uses: docker/build-push-action@v7
        continue-on-error: true
        with:
          context: .
          file: ./openam-distribution/openam-distribution-docker/Dockerfile
          build-args: |
            VERSION=${{ env.release_version }}
          platforms: linux/amd64, linux/arm64, linux/ppc64le, linux/s390x
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      - name: Prepare environment
        shell: bash
        run: |
          echo "OPENAM_IMAGE=localhost:5000/${GITHUB_REPOSITORY,,}:${{ env.release_version }}" >> $GITHUB_ENV
          docker network create test-openam
          echo "127.0.0.1 openam.example.org sp.mycompany.org" | sudo tee -a /etc/hosts

      - name: Docker test with an external OpenDJ identity store and an embedded OpenDJ configuration store (IDP)
        shell: bash
        run: |
          echo "Setup IDP"
  
          docker run --rm -it -d --hostname opendj-idp --name opendj-idp --network test-openam openidentityplatform/opendj:latest
          docker run --rm -it -d -p 8080:8080 -p 8000:8000 --memory="2g" -h openam.example.org --name=openam-idp --network test-openam \
            -e JPDA_ADDRESS=*:8000 \
            -e JPDA_TRANSPORT=dt_socket \
            ${OPENAM_IMAGE} catalina.sh jpda run
  
          echo "waiting for OpenDJ to be alive..."
          timeout 3m bash -c 'until docker inspect --format="{{json .State.Health.Status}}" opendj-idp | grep -q \"healthy\"; do sleep 10; done'
          echo "waiting for OpenAM to be alive..."
          timeout 3m bash -c 'until docker inspect --format="{{json .State.Health.Status}}" openam-idp | grep -q \"healthy\"; do sleep 10; done'
  
          docker exec -w '/usr/openam/ssoconfiguratortools' openam-idp bash -c \
          'echo "ACCEPT_LICENSES=true
          SERVER_URL=http://openam.example.org:8080
          DEPLOYMENT_URI=/$OPENAM_PATH
          BASE_DIR=$OPENAM_DATA_DIR
          locale=en_US
          PLATFORM_LOCALE=en_US
          AM_ENC_KEY=
          ADMIN_PWD=ampassword
          AMLDAPUSERPASSWD=password
          COOKIE_DOMAIN=example.org
          DATA_STORE=embedded
          DIRECTORY_SSL=SIMPLE
          DIRECTORY_SERVER=localhost
          DIRECTORY_PORT=1389
          DIRECTORY_ADMIN_PORT=5444
          DIRECTORY_JMX_PORT=1689
          ROOT_SUFFIX=dc=openam,dc=openidentityplatform,dc=org
          DS_DIRMGRDN=cn=Directory Manager
          DS_DIRMGRPASSWD=password
          USERSTORE_TYPE=LDAPv3ForOpenDS
          USERSTORE_SSL=SIMPLE
          USERSTORE_HOST=opendj-idp
          USERSTORE_PORT=1389
          USERSTORE_SUFFIX=dc=example,dc=com
          USERSTORE_MGRDN=cn=Directory Manager
          USERSTORE_PASSWD=password
          " > conf.file && java -jar openam-configurator-tool*.jar --file conf.file'

          echo "Setup ssoadm tools for OpenAM IDP"
        
          docker exec -w '/usr/openam/ssoadmintools' openam-idp bash -c './setup -p /usr/openam/config --acceptLicense'
        
          docker exec -w '/usr/openam/ssoadmintools/openam/bin' openam-idp bash -c 'echo ampassword > pwd.txt && chmod 400 pwd.txt'

          echo "Test IDP authentication"

          ADMIN_TOKEN=$(docker exec openam-idp bash -c \
          'curl -sf \
            --request POST \
            --header "Content-Type: application/json" \
            --header "X-OpenAM-Username: amadmin" \
            --header "X-OpenAM-Password: ampassword" \
            --data "{}" \
            http://openam.example.org:8080/openam/json/authenticate' |  jq -r .tokenId)

          docker inspect --format="{{json .State.Health.Status}}" openam-idp | grep -q \"healthy\"
        
          echo "Setup IDP test user"
        
          curl -sS -X POST \
            -H "iPlanetDirectoryPro: ${ADMIN_TOKEN}" \
            -H "Content-Type: application/json" \
            -H "Accept-API-Version: resource=3.0, protocol=2.1" \
            -d "{
              \"username\": \"demo\",
              \"userpassword\": \"changeit\",
              \"mail\": \"demo@example.com\",
              \"sn\": \"Demo\",
              \"givenName\": \"Demo\",
              \"cn\": \"Demo Demo\"
              }" \
            "http://openam.example.org:8080/openam/json/realms/root/users?_action=create"
        
          echo "Test demo user Auth"
        
          docker exec openam-idp bash -c \
            'curl -sf \
              --request POST \
              --header "Content-Type: application/json" \
              --header "X-OpenAM-Username: demo" \
              --header "X-OpenAM-Password: changeit" \
              --data "{}" \
              http://openam.example.org:8080/openam/json/authenticate'

      - name: Docker start with a dedicated OpenDJ container (SP)
        shell: bash
        run: |
          echo "Setup SP"

          docker run --rm -it -d --hostname opendj-sp --name opendj-sp --network test-openam openidentityplatform/opendj:latest
  
          docker run --rm -it -d -p 8081:8080 -p 8001:8000 --memory="2g" -h sp.mycompany.org --name=openam-sp --network test-openam \
            -e JPDA_ADDRESS=*:8000 \
            -e JPDA_TRANSPORT=dt_socket \
            ${OPENAM_IMAGE} catalina.sh jpda run
  
          echo "waiting for OpenDJ to be alive..."
          timeout 3m bash -c 'until docker inspect --format="{{json .State.Health.Status}}" opendj-sp | grep -q \"healthy\"; do sleep 10; done'
          echo "waiting for OpenAM to be alive..."
          timeout 3m bash -c 'until docker inspect --format="{{json .State.Health.Status}}" openam-sp | grep -q \"healthy\"; do sleep 10; done'
  
          docker exec -w '/usr/openam/ssoconfiguratortools' openam-sp bash -c \
          'echo "ACCEPT_LICENSES=true
          SERVER_URL=http://sp.mycompany.org:8080
          DEPLOYMENT_URI=/$OPENAM_PATH
          BASE_DIR=$OPENAM_DATA_DIR
          locale=en_US
          PLATFORM_LOCALE=en_US
          AM_ENC_KEY=
          ADMIN_PWD=ampassword
          AMLDAPUSERPASSWD=password
          COOKIE_DOMAIN=mycompany.org
          DATA_STORE=dirServer
          DIRECTORY_SSL=SIMPLE
          DIRECTORY_SERVER=opendj-sp
          DIRECTORY_PORT=1389
          DIRECTORY_ADMIN_PORT=4444
          DIRECTORY_JMX_PORT=1689
          ROOT_SUFFIX=dc=example,dc=com
          DS_DIRMGRDN=cn=Directory Manager
          DS_DIRMGRPASSWD=password
          USERSTORE_TYPE=LDAPv3ForOpenDS
          USERSTORE_SSL=SIMPLE
          USERSTORE_HOST=opendj-sp
          USERSTORE_PORT=1389
          USERSTORE_SUFFIX=dc=example,dc=com
          USERSTORE_MGRDN=cn=Directory Manager
          USERSTORE_PASSWD=password
          " > conf.file && java -jar openam-configurator-tool*.jar --file conf.file'

          echo "Setup ssoadm tools for OpenAM SP"
 
          docker exec -w '/usr/openam/ssoadmintools' openam-sp bash -c './setup -p /usr/openam/config --acceptLicense'
  
          docker exec -w '/usr/openam/ssoadmintools/openam/bin' openam-sp bash -c 'echo ampassword > pwd.txt && chmod 400 pwd.txt'
          
          echo "Test SP authentication"
  
          docker exec openam-sp bash -c \
            'curl \
              --request POST \
              --header "Content-Type: application/json" \
              --header "X-OpenAM-Username: amadmin" \
              --header "X-OpenAM-Password: ampassword" \
              --data "{}" \
              http://sp.mycompany.org:8080/openam/json/authenticate | grep tokenId'
        
          docker inspect --format="{{json .State.Health.Status}}" openam-sp | grep -q \"healthy\"

      - name: Cache Playwright browsers
        uses: actions/cache@v5
        with:
          path: ~/.cache/ms-playwright
          key: ${{ runner.os }}-playwright-browsers
          restore-keys: ${{ runner.os }}-playwright-

      - uses: actions/checkout@v6
        with:
          sparse-checkout: e2e

      - name: UI Smoke Tests (Playwright) - HttpOnly disabled
        env:
          EXPECT_COOKIE_HTTPONLY: "false"
        run: |
          cd e2e
          npm init -y
          npm install @playwright/test
          npx playwright install chromium --with-deps
          npx playwright test --reporter=list

      - name: Enable HttpOnly session cookie on OpenAM IDP and restart
        shell: bash
        run: |
          # com.sun.identity.cookie.httponly is read once at startup (static field
          # in CookieUtils) and SystemProperties gives JVM -D properties priority,
          # so we inject it via Tomcat setenv.sh and restart the same container
          # (its configured data dir is preserved across a restart).
          docker exec openam-idp bash -c '
            echo "export CATALINA_OPTS=\"\$CATALINA_OPTS -Dcom.sun.identity.cookie.httponly=true\"" > "$CATALINA_HOME/bin/setenv.sh"
            chmod +x "$CATALINA_HOME/bin/setenv.sh"'
          docker restart openam-idp
          echo "waiting for OpenAM IDP to be alive again..."
          timeout 3m bash -c 'until docker inspect --format="{{json .State.Health.Status}}" openam-idp | grep -q \"healthy\"; do sleep 10; done'
          echo "verifying the server now reports cookieHttpOnly=true"
          curl -sf "http://openam.example.org:8080/openam/json/serverinfo/*" | jq -e '.cookieHttpOnly == true'

      - name: UI Smoke Tests (Playwright) - HttpOnly enabled
        env:
          EXPECT_COOKIE_HTTPONLY: "true"
        run: |
          cd e2e
          npx playwright test xui --reporter=list

      - name: Upload failure artifacts
        uses: actions/upload-artifact@v7
        if: ${{ failure() }}
        with:
          name: failure-ui
          retention-days: 1
          path: |
            e2e/playwright-report/**
            e2e/test-results/**    

      - name: Stopping containers and removing the network
        shell: bash
        run: |
          docker stop openam-idp opendj-idp opendj-sp openam-sp
          docker network rm test-openam

      - name: Docker multi-server test
        shell: bash
        run: |
          
          docker network create test-openam
          
          echo "Starting OpenAM-1 container"
          docker run --rm -it -d -h openam1.example.org --name=test-openam1 --network test-openam localhost:5000/${GITHUB_REPOSITORY,,}:${{ env.release_version }}
          
          echo "Waiting for OpenAM-1 to be alive..."
          timeout 3m bash -c 'until docker inspect --format="{{json .State.Health.Status}}" test-openam1 | grep -q \"healthy\"; do sleep 10; done'
          
          docker exec -w '/usr/openam/ssoconfiguratortools' test-openam1 bash -c \
          'echo "ACCEPT_LICENSES=true
          SERVER_URL=http://openam1.example.org:8080
          DEPLOYMENT_URI=/$OPENAM_PATH
          BASE_DIR=$OPENAM_DATA_DIR
          locale=en_US
          PLATFORM_LOCALE=en_US
          AM_ENC_KEY=O6QWwHPO4os+zEz3Nqn/2daAYWyiFE32
          ADMIN_PWD=ampassword
          AMLDAPUSERPASSWD=password
          COOKIE_DOMAIN=example.org
          ACCEPT_LICENSES=true
          DATA_STORE=embedded
          DIRECTORY_SSL=SIMPLE
          DIRECTORY_SERVER=openam1.example.org
          DIRECTORY_PORT=50389
          DIRECTORY_ADMIN_PORT=4444
          DIRECTORY_JMX_PORT=1689
          ROOT_SUFFIX=dc=openam,dc=example,dc=org
          DS_DIRMGRDN=cn=Directory Manager
          DS_DIRMGRPASSWD=password
          LB_SITE_NAME=lb
          LB_PRIMARY_URL=http://lb.example.org:80/openam
          " > conf.file && java -jar openam-configurator-tool*.jar --file conf.file'
          
          docker exec test-openam1 bash -c \
          'curl \
           --request POST \
           --header "Content-Type: application/json" \
           --header "X-OpenAM-Username: amadmin" \
           --header "X-OpenAM-Password: ampassword" \
           --data "{}" \
           http://openam1.example.org:8080/openam/json/authenticate | grep tokenId'
          
          docker inspect --format="{{json .State.Health.Status}}" test-openam1 | grep -q \"healthy\"
          
          echo "Add another two OpenAM servers to the cluster"
          
          echo "Starting OpenAM-2 container..."
          docker run --rm -it -d -h openam2.example.org --name=test-openam2 --network test-openam localhost:5000/${GITHUB_REPOSITORY,,}:${{ env.release_version }}
          
          echo "waiting for OpenAM-2 to be alive..."
          timeout 3m bash -c 'until docker inspect --format="{{json .State.Health.Status}}" test-openam2 | grep -q \"healthy\"; do sleep 10; done'
          
          docker exec -w '/usr/openam/ssoconfiguratortools' test-openam2 bash -c \
          'echo "ACCEPT_LICENSES=true
          SERVER_URL=http://openam2.example.org:8080
          DEPLOYMENT_URI=/$OPENAM_PATH
          BASE_DIR=$OPENAM_DATA_DIR
          locale=en_US
          PLATFORM_LOCALE=en_US
          AM_ENC_KEY=O6QWwHPO4os+zEz3Nqn/2daAYWyiFE32
          ADMIN_PWD=ampassword
          AMLDAPUSERPASSWD=password
          COOKIE_DOMAIN=example.org
          ACCEPT_LICENSES=true
          DATA_STORE=embedded
          DIRECTORY_SSL=SIMPLE
          DIRECTORY_SERVER=openam2.example.org
          DIRECTORY_PORT=50389
          DIRECTORY_ADMIN_PORT=4444
          DIRECTORY_JMX_PORT=1689
          ROOT_SUFFIX=dc=openam,dc=example,dc=org
          DS_DIRMGRDN=cn=Directory Manager
          DS_DIRMGRPASSWD=password
          DS_EMB_REPL_FLAG=embReplFlag
          DS_EMB_REPL_REPLPORT1=8989
          DS_EMB_REPL_HOST2=openam1.example.com
          DS_EMB_REPL_ADMINPORT2=4444
          DS_EMB_REPL_REPLPORT2=8989
          existingserverid=http://openam1.example.org:8080
          LB_SITE_NAME=lb
          LB_PRIMARY_URL=http://lb.example.org:80/openam
          " > conf.file && java -jar openam-configurator-tool*.jar --file conf.file'
  
          docker exec test-openam2 bash -c \
          'curl \
          --request POST \
          --header "Content-Type: application/json" \
          --header "X-OpenAM-Username: amadmin" \
          --header "X-OpenAM-Password: ampassword" \
          --data "{}" \
          http://openam2.example.org:8080/openam/json/authenticate | grep tokenId'
          
          docker inspect --format="{{json .State.Health.Status}}" test-openam2 | grep -q \"healthy\"
          
          echo "Starting OpenAM-3 container..."
          docker run --rm -it -d -h openam3.example.org --name=test-openam3 --network test-openam localhost:5000/${GITHUB_REPOSITORY,,}:${{ env.release_version }}

          echo "waiting for OpenAM-3 to be alive..."
          timeout 3m bash -c 'until docker inspect --format="{{json .State.Health.Status}}" test-openam3 | grep -q \"healthy\"; do sleep 10; done'

          docker exec -w '/usr/openam/ssoconfiguratortools' test-openam2 bash -c \
          'echo "ACCEPT_LICENSES=true
          SERVER_URL=http://openam3.example.org:8080
          DEPLOYMENT_URI=/$OPENAM_PATH
          BASE_DIR=$OPENAM_DATA_DIR
          locale=en_US
          PLATFORM_LOCALE=en_US
          AM_ENC_KEY=O6QWwHPO4os+zEz3Nqn/2daAYWyiFE32
          ADMIN_PWD=ampassword
          AMLDAPUSERPASSWD=password
          COOKIE_DOMAIN=example.org
          ACCEPT_LICENSES=true
          DATA_STORE=embedded
          DIRECTORY_SSL=SIMPLE
          DIRECTORY_SERVER=openam3.example.org
          DIRECTORY_PORT=50389
          DIRECTORY_ADMIN_PORT=4444
          DIRECTORY_JMX_PORT=1689
          ROOT_SUFFIX=dc=openam,dc=example,dc=org
          DS_DIRMGRDN=cn=Directory Manager
          DS_DIRMGRPASSWD=password
          DS_EMB_REPL_FLAG=embReplFlag
          DS_EMB_REPL_REPLPORT1=8989
          DS_EMB_REPL_HOST2=openam2.example.com
          DS_EMB_REPL_ADMINPORT2=4444
          DS_EMB_REPL_REPLPORT2=9989
          existingserverid=http://openam2.example.org:8080
          LB_SITE_NAME=lb
          LB_PRIMARY_URL=http://lb.example.org:80/openam
          " > conf.file && java -jar openam-configurator-tool*.jar --file conf.file'

          docker exec test-openam3 bash -c \
          'curl \
          --request POST \
          --header "Content-Type: application/json" \
          --header "X-OpenAM-Username: amadmin" \
          --header "X-OpenAM-Password: ampassword" \
          --data "{}" \
          http://openam3.example.org:8080/openam/json/authenticate | grep tokenId'

          docker inspect --format="{{json .State.Health.Status}}" test-openam3 | grep -q \"healthy\"