# Authelia + OpenZiti Testing Checklist

## 📋 Pre-Flight Checks

- [ ] Docker Desktop is running
- [ ] Ports 80, 443, 9091, 1280, 8443 are available
- [ ] At least 4GB RAM available for Docker
- [ ] Internet connection (for pulling images)

## 🚀 Setup Phase

### Extract and Prepare
```bash
tar -xzf authelia-openziti-complete.tar.gz
cd complete-setup
```

- [ ] Package extracted successfully
- [ ] All directories present (authelia/, ziti/, nginx/, certs/)
- [ ] setup-complete.sh is executable

### Run Setup Script
```bash
./setup-complete.sh
```

- [ ] Script completes without errors
- [ ] Secrets generated in authelia/secrets/
- [ ] Certificates created in certs/
- [ ] OpenZiti PKI created in ziti/pki/
- [ ] RSA key and certificate displayed

### Update Configuration
- [ ] Copy RSA private key from terminal output
- [ ] Copy RSA certificate from terminal output
- [ ] Update authelia/config.yml JWKS section
- [ ] Save authelia/config.yml

## 🐳 Docker Phase

### Start Services
```bash
docker-compose up -d
```

- [ ] All 5 containers start (authelia, ziti-controller, ziti-router, ziti-console, nginx)
- [ ] No errors in `docker-compose logs`
- [ ] Wait 30 seconds for services to initialize

### Verify Containers
```bash
docker-compose ps
```

Expected output:
```
NAME              STATUS
authelia          Up (healthy)
ziti-controller   Up (healthy)
ziti-router       Up (healthy)
ziti-console      Up
nginx-proxy       Up (healthy)
```

- [ ] All containers show "Up" status
- [ ] authelia shows "(healthy)"
- [ ] ziti-controller shows "(healthy)"
- [ ] nginx-proxy shows "(healthy)"

## ✅ Authelia Testing

### Test 1: Health Check
```bash
curl -k https://localhost:9091/api/health
```

Expected: `{"status":"UP"}`

- [ ] Returns HTTP 200
- [ ] Response shows status UP

### Test 2: OIDC Discovery
```bash
curl -k https://localhost:9091/.well-known/openid-configuration | jq
```

- [ ] Returns JSON configuration
- [ ] Contains `issuer` field
- [ ] Contains `authorization_endpoint`
- [ ] Contains `token_endpoint`
- [ ] Contains `jwks_uri`

### Test 3: JWKS Endpoint
```bash
curl -k https://localhost:9091/jwks.json | jq
```

- [ ] Returns JSON with keys array
- [ ] Contains at least one key
- [ ] Key has `kty`, `use`, `kid` fields

### Test 4: Web UI Login
1. Open browser: https://localhost:9091
2. Accept certificate warning
3. Login page appears

- [ ] Authelia login page loads
- [ ] No JavaScript errors in console
- [ ] Username/password fields visible

4. Enter credentials:
   - Username: `admin`
   - Password: `password123`
5. Click "Sign in"

- [ ] Login successful
- [ ] Redirected to portal or shows success
- [ ] No error messages

### Test 5: Test Different Users
Test login with each user:

- [ ] admin / password123 ✓
- [ ] manager / password123 ✓
- [ ] john / password123 ✓
- [ ] jane / password123 ✓

## 🔷 OpenZiti Testing

### Test 1: Controller Health
```bash
curl -k https://localhost:1280/version
```

- [ ] Returns OpenZiti version info
- [ ] HTTP 200 response

### Test 2: Controller Login
```bash
# If ziti CLI installed on host
ziti edge login https://localhost:1280 -u admin -p admin123 -y
```

OR

```bash
# Using docker exec
docker exec -it ziti-controller ziti edge login localhost:1280 -u admin -p admin123
```

- [ ] Login successful
- [ ] Session created
- [ ] No certificate errors (with -y flag)

### Test 3: List Edge Routers
```bash
docker exec -it ziti-controller ziti edge list edge-routers
```

- [ ] Command succeeds
- [ ] Shows at least one router (ziti-router)
- [ ] Router is online

### Test 4: Ziti Admin Console
1. Open browser: https://localhost:8443
2. Accept certificate warning

- [ ] ZAC loads successfully
- [ ] Login prompt appears OR auto-connects

## 🔗 Integration Testing

### Test 1: Create External JWT Signer

```bash
docker exec -it ziti-controller ziti edge login localhost:1280 -u admin -p admin123

docker exec -it ziti-controller ziti edge create ext-jwt-signer authelia-oidc \
    "https://authelia:9091" \
    --jwks-endpoint "https://authelia:9091/jwks.json" \
    --audience "openziti" \
    --claims-property "email"
```

- [ ] ext-jwt-signer created successfully
- [ ] No errors about unreachable JWKS
- [ ] Can list with `ziti edge list ext-jwt-signers`

### Test 2: Create Auth Policy

```bash
docker exec -it ziti-controller ziti edge create auth-policy "authelia-auth-policy" \
    --primary-ext-jwt-allowed \
    --primary-ext-jwt-allowed-signers "authelia-oidc"
```

- [ ] auth-policy created successfully
- [ ] Can list with `ziti edge list auth-policies`

### Test 3: Create Test Identity

```bash
docker exec -it ziti-controller ziti edge create identity user "admin@localhost" \
    --auth-policy "authelia-auth-policy" \
    --external-id "admin@localhost" \
    -o /tmp/admin.jwt

docker cp ziti-controller:/tmp/admin.jwt ./
```

- [ ] Identity created successfully
- [ ] JWT file copied to host
- [ ] Can view JWT: `cat admin.jwt`

### Test 4: Verify Identity
```bash
docker exec -it ziti-controller ziti edge list identities
```

- [ ] admin@localhost identity visible
- [ ] External ID shows "admin@localhost"
- [ ] Auth policy is "authelia-auth-policy"

## 🌐 Nginx Proxy Testing

### Test 1: HTTP to HTTPS Redirect
```bash
curl -I http://localhost
```

- [ ] Returns 301 redirect
- [ ] Location header points to https://

### Test 2: HTTPS Access
```bash
curl -k https://localhost
```

- [ ] Returns 302 redirect to /auth
- [ ] OR serves content

### Test 3: Authelia via Proxy
```bash
curl -k https://localhost/auth
```

- [ ] Returns Authelia login page
- [ ] No proxy errors

### Test 4: Proxy Logs
```bash
cat nginx/logs/access.log
cat nginx/logs/error.log
```

- [ ] Access log shows requests
- [ ] No critical errors in error.log

## 🔍 Service Logs Review

### Check Authelia Logs
```bash
docker-compose logs authelia | tail -50
```

Look for:
- [ ] "Authelia is listening on" message
- [ ] No ERROR level messages
- [ ] OIDC endpoints initialized
- [ ] Database migrations completed

### Check Ziti Controller Logs
```bash
docker-compose logs ziti-controller | tail -50
```

Look for:
- [ ] Controller started successfully
- [ ] Edge router enrolled
- [ ] API listening on port 1280
- [ ] No panic or fatal errors

### Check Nginx Logs
```bash
docker-compose logs nginx | tail -30
```

Look for:
- [ ] Nginx started successfully
- [ ] No upstream connection errors
- [ ] SSL certificates loaded

## 🎯 Advanced Tests

### Test 1: OIDC Token Exchange (Manual)

1. Get authorization URL:
```
https://localhost:9091/api/oidc/authorization?client_id=openziti&redirect_uri=http://localhost:20314/auth/callback&response_type=code&scope=openid+email+profile&state=test123
```

2. Login via browser
3. Capture authorization code from redirect
4. Exchange for token (requires PKCE - use real client)

- [ ] Can access authorization endpoint
- [ ] Login redirects with code
- [ ] Token endpoint accessible

### Test 2: Network Connectivity Between Containers

```bash
# Test authelia -> ziti-controller
docker exec authelia curl -k https://ziti-controller:1280/version

# Test ziti-controller -> authelia
docker exec ziti-controller curl -k https://authelia:9091/api/health

# Test nginx -> authelia
docker exec nginx-proxy curl -k https://authelia:9091/api/health
```

- [ ] All container-to-container requests succeed
- [ ] No DNS resolution errors
- [ ] No connection refused errors

### Test 3: Resource Cleanup

```bash
docker exec -it ziti-controller ziti edge delete identity admin@localhost
docker exec -it ziti-controller ziti edge delete auth-policy authelia-auth-policy
docker exec -it ziti-controller ziti edge delete ext-jwt-signer authelia-oidc
```

- [ ] Resources deleted successfully
- [ ] Can recreate resources

## 📊 Final Verification

### System Status Check

```bash
# All containers running
docker-compose ps

# No container restarts
docker-compose ps | grep -i restart

# Disk usage reasonable
docker system df

# Check memory usage
docker stats --no-stream
```

- [ ] All 5 containers running
- [ ] No containers restarting
- [ ] Memory usage < 2GB total
- [ ] CPU usage normal

### Endpoint Summary

Test all endpoints respond:

- [ ] https://localhost:9091 (Authelia)
- [ ] https://localhost:9091/api/health (Health)
- [ ] https://localhost:9091/.well-known/openid-configuration (OIDC)
- [ ] https://localhost:9091/jwks.json (JWKS)
- [ ] https://localhost:1280 (Ziti Controller)
- [ ] https://localhost:8443 (Ziti Console)
- [ ] https://localhost (Nginx)

## ✅ Success Criteria

### Minimum Requirements
- [x] All containers start and stay running
- [x] Authelia login works
- [x] OIDC discovery endpoint responds
- [x] JWKS endpoint returns keys
- [x] OpenZiti controller accessible
- [x] Can create ext-jwt-signer

### Full Success
- [x] All minimum requirements
- [x] Can create OIDC-authenticated identity
- [x] Nginx proxy works correctly
- [x] All service logs clean
- [x] Inter-container networking works
- [x] ZAC console accessible

## 🐛 If Tests Fail

### Authelia Issues
```bash
# Restart Authelia
docker-compose restart authelia

# Check config syntax
docker exec authelia cat /config/configuration.yml

# View detailed logs
docker-compose logs authelia -f

# Verify secrets exist
docker exec authelia ls -la /config/secrets/
```

### OpenZiti Issues
```bash
# Restart controller
docker-compose restart ziti-controller

# Check PKI
docker exec ziti-controller ls -la /openziti/pki/

# Reinitialize (destructive)
docker-compose down -v
rm -rf ziti/
./setup-complete.sh
docker-compose up -d
```

### Network Issues
```bash
# Check Docker network
docker network inspect ziti-network

# Restart all services
docker-compose restart

# Recreate network
docker-compose down
docker-compose up -d
```

## 📝 Notes

Record any issues or observations here:

```
Date: _____________
Tester: _____________

Issues Found:
1. 
2. 
3. 

Resolutions:
1. 
2. 
3. 

Additional Notes:


```

---

**Test Date:** ______________  
**Tester:** ______________  
**Result:** ⬜ Pass | ⬜ Fail | ⬜ Partial  
**Time Taken:** ______________