Instantiating IAM with a pre-defined and configurable client

[aldbr]

For testing purposes, I would like to instantiate IAM with a pre-defined and configurable client.
Basically, I don't want to manually create/modify a client each time I run my tests.
Is this possible?

In the documentation, I see a reference to a "Test Client" but it does not work. Is this expected?
https://indigo-iam.github.io/v/v1.8.2/docs/reference/configuration/#test-client-configuration

Even if it would work, there is no way to specify:

• the grant types
• the redirect uris (well, actually there is an environment variable used within the code but not specified in the documentation)

I also tried to play with the APIs:

• create a new client: using the grant-password and the password flow, I can get some admin AT/RT tokens and create a new client. But this is not what I want (ideally, I want an existing client id)
• update an existing client: this does not seem feasible, because I cannot get access to the client registration access tokens and there is no existing client with the iam:admin.read/write scope.

Defining the "Test Client" with environment variables would be great!

Thanks

[rmiccoli]

Hi, Test Client is a simple web app that uses authorization code flow (i.e. grant type) or authorization code + PKCE (if you specify the code challenge method with this property iam.client.codeChallengeMethod=plain|S256 . It is not possible to change the grant type via a configuration env variable.
Anyway, IAM Test Client app should work, what kind of error do you get?
Also, the redirect uris can be specified via the env variable IAM_CLIENT_REDIRECT_URIS and we'll update the documentation accordingly (thanks you).

[aldbr]

Ok so I probably misunderstood "Test Client".
When I launch a new instance of IAM, in the "Clients" tab I can see a client named "Test Client": I thought that the environment variables were here to modify it.

Then, is there a way to initialize an IAM instance with a predefined and configurable client?
For instance, I would like to start IAM with a client that would have 3 grant types: authorization_code/device_code and refresh_token (currently, there is no predefined client with this combination of grant types) and 2 specific redirect uris.

Thanks

[rmiccoli]

If you are an IAM admin, you can modify the client named Test Client (which already has authorization code and refresh token grant types checked) through the IAM dashboard. You can change the grant types and/or also add the redirect uris manually.
Or, you can enable the h2-test profile that initializes IAM with a set of predefined clients and you can use what you need for testing.

[aldbr]

If you are an IAM admin, you can modify the client named Test Client (which already has authorization code and refresh token grant types checked) through the IAM dashboard

Does it mean that there is no possibility to modify an existing client without manually going through the IAM dashboard?
If I cannot modify an existing client through the API without interacting with the IAM dashboard, is there a way to modify an existing client by interacting with the database for instance? Is there a documented procedure for that?

you can enable the h2-test profile that initializes IAM with a set of predefined clients and you can use what you need for testing.

Yes indeed, I am using the h2-test profile. But there is no predefined clients that would fit with my use case. And I cannot modify them using the API since I would need the iam:admin.read/write scope to get the client details and modify them, and there is no predefined client with such a scope.

I think it would make sense to add at least one client with such a scope in h2-test to allow one to get a real admin AT. Am I wrong?

Thanks!

[federicaagostini]

If you are running the pre-release candidate (tag v1.8.3.rc.20231211 of the docker image, or develop branch of source code) you can use the client_id admin-client-rw which has the predefined admin scopes.

If this client is not the one you are looking at, you can anyhow use it for asking for an access token (with client credential flow for instance) and modify Test Client with PUT http://<iam-host:port>/iam/api/clients/client.

[aldbr]

Perfect! This is exactly what I was looking for, thanks.