test: Add conformance tests for Vault signer integration (#4520)

Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>
Signed-off-by: Maksim Nabokikh <max.nabokih@gmail.com>
Co-authored-by: Alwx <alwxsin@gmail.com>

.github/workflows/ci.yaml

@@ -64,6 +64,24 @@ jobs:
           - 35357
         options: --health-cmd "curl --fail http://localhost:5000/v3" --health-interval 10s --health-timeout 5s --health-retries 5
 
+      vault:
+        image: hashicorp/vault:1.21
+        ports:
+          - 8200
+        env:
+          VAULT_DEV_ROOT_TOKEN_ID: root-token
+          VAULT_DEV_LISTEN_ADDRESS: "0.0.0.0:8200"
+        options: --health-cmd "vault status -address=http://localhost:8200 || exit 1" --health-interval 10s --health-timeout 5s --health-retries 5
+
+      openbao:
+        image: quay.io/openbao/openbao:2.5
+        ports:
+          - 8210
+        env:
+          BAO_DEV_ROOT_TOKEN_ID: root-token
+          BAO_DEV_LISTEN_ADDRESS: "0.0.0.0:8210"
+        options: --health-cmd "bao status -address=http://localhost:8210 || exit 1" --health-interval 10s --health-timeout 5s --health-retries 5
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -129,6 +147,11 @@ jobs:
           DEX_KEYSTONE_ADMIN_USER: demo
           DEX_KEYSTONE_ADMIN_PASS: DEMO_PASS
 
+          DEX_VAULT_ADDR: http://localhost:${{ job.services.vault.ports[8200] }}
+          DEX_VAULT_TOKEN: root-token
+          DEX_OPENBAO_ADDR: http://localhost:${{ job.services.openbao.ports[8210] }}
+          DEX_OPENBAO_TOKEN: root-token
+
           DEX_KUBERNETES_CONFIG_PATH: ~/.kube/config
 
   lint:

docker-compose.yaml

@@ -45,3 +45,23 @@ services:
         volumes:
             - ./connector/ldap/testdata/certs:/container/service/slapd/assets/certs
             - ./connector/ldap/testdata/schema.ldif:/container/service/slapd/assets/config/bootstrap/ldif/99-schema.ldif
+
+    vault:
+        image: hashicorp/vault:1.21
+        environment:
+            VAULT_DEV_ROOT_TOKEN_ID: root-token
+            VAULT_DEV_LISTEN_ADDRESS: "0.0.0.0:8200"
+        cap_add:
+            - IPC_LOCK
+        ports:
+            - 8200:8200
+
+    openbao:
+        image: quay.io/openbao/openbao:2.5
+        environment:
+            BAO_DEV_ROOT_TOKEN_ID: root-token
+            BAO_DEV_LISTEN_ADDRESS: "0.0.0.0:8200"
+        cap_add:
+            - IPC_LOCK
+        ports:
+            - 8210:8200

server/signer_vault.go

@@ -247,7 +247,45 @@ func (v *vaultSigner) getTransitKeysMap(ctx context.Context) (map[int64]*jose.JS
 func parsePEMToJWK(pemStr string) (*jose.JSONWebKey, error) {
 	block, _ := pem.Decode([]byte(pemStr))
 	if block == nil {
-		return nil, fmt.Errorf("failed to parse PEM block")
+		// OpenBao may return ED25519 keys as raw base64-encoded strings instead of PEM
+		// Try to decode as raw base64 ED25519 key
+		keyBytes, err := base64.StdEncoding.DecodeString(pemStr)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse PEM block or base64: %v", err)
+		}
+
+		// Check if it's a raw 32-byte ED25519 key
+		var ed25519Key ed25519.PublicKey
+		if len(keyBytes) == 32 {
+			ed25519Key = ed25519.PublicKey(keyBytes)
+		} else {
+			// Try to parse as PKIX public key
+			pub, err := x509.ParsePKIXPublicKey(keyBytes)
+			if err != nil {
+				return nil, fmt.Errorf("failed to parse raw key: %v", err)
+			}
+
+			// Create JWK for ED25519 key
+			var ok bool
+			ed25519Key, ok = pub.(ed25519.PublicKey)
+			if !ok {
+				return nil, fmt.Errorf("expected ED25519 key, got %T", pub)
+			}
+		}
+
+		jwk := &jose.JSONWebKey{
+			Key:       ed25519Key,
+			Algorithm: "EdDSA",
+			Use:       "sig",
+		}
+
+		thumbprint, err := jwk.Thumbprint(crypto.SHA256)
+		if err != nil {
+			return nil, err
+		}
+		jwk.KeyID = base64.RawURLEncoding.EncodeToString(thumbprint)
+
+		return jwk, nil
 	}
 
 	pub, err := x509.ParsePKIXPublicKey(block.Bytes)