feat(config-api): replacing testing framework to TestNG

[pujavs]

Prepare

• Read PR guidelines
• Read license information

---

Description

9125: Replaced testing framework from Karate to TestNG

Target issue

closes #9125

Implementation Details

---

Test and Document the changes

• Static code analysis has been run locally and issues have been fixed
• Relevant unit and integration tests have been added/updated
• Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

• I confirm that there is no impact on the docs due to the code changes in this PR.

[dryrunsecurity]

DryRun Security Summary

The pull request focuses on updating the testing infrastructure for the Jans Config API project by replacing the Karate testing framework with TestNG, adding new test cases for various functionalities, and improving build and deployment configurations.

Expand for full summary

Summary:

The code changes in this pull request span across multiple files and modules of the Jans Config API project, with a focus on updating the testing infrastructure and configuration. The key changes include:

1. Removal of Karate testing framework and adoption of TestNG as the new testing framework for the admin-ui-plugin and fido2-plugin modules.
2. Addition of new test cases and test suites for various functionalities, such as OAuth2, audit logging, license management, and FIDO2 configuration.
3. Updates to the test configuration files, including the expansion of OAuth2 scopes, addition of test environment settings, and inclusion of custom test listeners.
4. Modifications to the build and deployment configuration, such as the addition of Swagger documentation generation and the distribution of the plugin JAR file.

From an application security perspective, the changes do not appear to introduce any immediate security vulnerabilities. However, it is important to review the actual implementation of the tested functionalities, as well as the test cases themselves, to ensure that proper security measures are in place, such as input validation, secure authentication and authorization, and proper handling of sensitive data.

Additionally, the expansion of the OAuth2 scopes and the inclusion of custom test listeners should be closely examined to ensure that they do not inadvertently expose sensitive configuration settings or introduce potential privilege escalation vulnerabilities.

Overall, the changes seem to be focused on improving the testing and deployment infrastructure of the Jans Config API project, which is a positive step towards ensuring the security and reliability of the application.

Files Changed:

1. jans-config-api/common/pom.xml: Removed the configuration for the maven-surefire-plugin to ensure that all tests are run during the build process.
2. jans-config-api/.gitignore: Added the test-output/ directory to the .gitignore file to exclude test-related artifacts from the Git repository.
3. jans-config-api/plugins/admin-ui-plugin/src/test/java/io/jans/ca/plugin/adminui/AdminUIBaseTest.java: Added a new test class that extends the BaseTest class and implements the getAccessToken() method to obtain an access token for the tests.
4. jans-config-api/plugins/admin-ui-plugin/pom.xml: Updated the dependency management and build configuration, including the addition of the swagger-maven-plugin-jakarta for generating Swagger documentation.
5. jans-config-api/plugins/admin-ui-plugin/src/test/java/io/jans/ca/plugin/adminui/test/LicenseResourceTest.java: Added a new test case for the LicenseResource endpoint.
6. jans-config-api/plugins/admin-ui-plugin/src/test/java/io/jans/ca/plugin/adminui/test/AuditLoggingResourceTest.java: Added a new test case for the audit logging functionality.
7. jans-config-api/plugins/admin-ui-plugin/src/test/java/io/jans/ca/plugin/adminui/test/OAuth2ResourceTest.java: Added new test cases for the OAuth2 functionality.
8. jans-config-api/plugins/admin-ui-plugin/src/test/resources/json/auth/license.feature: Added a new Cucumber feature test for the 'checkLicense' GET endpoint.
9. jans-config-api/plugins/admin-ui-plugin/src/test/resources/json/auth/auditLogging.feature: Added a new Cucumber feature test for the 'auditLogging' POST endpoint.
10. jans-config-api/plugins/admin-ui-plugin/src/test/resources/json/logging/logging-post.json: Added a new JSON file for testing the logging functionality.
11. jans-config-api/plugins/admin-ui-plugin/src/test/resources/json/auth/oauth2.feature: Added new Karate test scenarios for the OAuth2 functionality.
12. jans-config-api/plugins/admin-ui-plugin/src/test/resources/testng.xml: Added a new TestNG suite for the Config API, including test cases for OAuth2, Logging, and License.
13. jans-config-api/plugins/fido2-plugin/pom.xml: Removed Karate testing dependencies

Code Analysis

We ran 9 analyzers against 30 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	3 findings

View PR in the DryRun Dashboard.

[pujavs]

I am fixing Sonar reported issues

[sonarqubecloud]

Quality Gate failed for 'jans-config-api-parent'

Failed conditions
1 Security Hotspot
111 New Code Smells (required ≤ 8)
1 New Bugs (required ≤ 0)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[sonarqubecloud]

Quality Gate passed for 'agama parent'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed for 'jans-linux-setup'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed for 'Jans-Keycloak-Link'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed for 'SCIM API'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud