-
Notifications
You must be signed in to change notification settings - Fork 25k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[Backport 7.11] Add a smoke test for security realms (#68951)
This changes adds a new QA test that runs a smoke test on a node that has been configured with one realm of each type. Not all of the realms work, because some of them would depend on external fixtures (LDAP, SAML, etc) and this particularly test suite is intended to be as stable as possible and have no external dependencies. The primary purpose of this test is to catch any issues that prevent a node from starting with particular realms configurd (e.g. security manager or classpath issues). We don't depend on external fixtures becaused we want this to be a smoke test that clearly indicates when a (seemingly unrelated) change in Elasticsearch has unintended consequences on realms. The use of external dependencies would increase the number of things that could go wrong and move this from a smoke test to a potentially noisy integration test. Backport of: #68881
- Loading branch information
Showing
23 changed files
with
823 additions
and
14 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
85 changes: 85 additions & 0 deletions
85
x-pack/plugin/security/qa/smoke-test-all-realms/build.gradle
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,85 @@ | ||
| /* | ||
| * This QA test is intended to smoke test all security realms with minimal dependencies. | ||
| * That is, it makes sure a node that has every realm configured can start, and tests those realms that can be tested without needing external services. | ||
| * This tradeoff is intentional because we want this set of tests to be very stable - failures in this QA suite should be an indicator that | ||
| * something is broken in Elasticsearch (and not that an external docker fixture broke) | ||
| * This test is also intended to work correctly on FIPS mode because we also want to know if a realm breaks on FIPS. | ||
| */ | ||
|
|
||
| apply plugin: 'elasticsearch.java-rest-test' | ||
|
|
||
| dependencies { | ||
| javaRestTestImplementation project(path: xpackModule('core')) | ||
| javaRestTestImplementation project(path: xpackModule('security'), configuration: 'testArtifacts') | ||
| javaRestTestImplementation project(path: xpackModule('core'), configuration: 'testArtifacts') | ||
| } | ||
|
|
||
| testClusters.javaRestTest { | ||
| testDistribution = 'DEFAULT' | ||
| numberOfNodes = 2 | ||
|
|
||
| extraConfigFile 'http-server.key', file('src/javaRestTest/resources/ssl/http-server.key') | ||
| extraConfigFile 'http-server.crt', file('src/javaRestTest/resources/ssl/http-server.crt') | ||
| extraConfigFile 'http-client-ca.crt', file('src/javaRestTest/resources/ssl/http-client-ca.crt') | ||
| extraConfigFile 'saml-metadata.xml', file('src/javaRestTest/resources/saml-metadata.xml') | ||
| extraConfigFile 'kerberos.keytab', file('src/javaRestTest/resources/kerberos.keytab') | ||
| extraConfigFile 'oidc-jwkset.json', file('src/javaRestTest/resources/oidc-jwkset.json') | ||
|
|
||
| setting 'xpack.ml.enabled', 'false' | ||
| setting 'xpack.security.enabled', 'true' | ||
| setting 'xpack.security.authc.token.enabled', 'true' | ||
| setting 'xpack.security.authc.api_key.enabled', 'true' | ||
|
|
||
| // Need a trial license (not basic) to enable all realms | ||
| setting 'xpack.license.self_generated.type', 'trial' | ||
| // Need SSL to enable PKI realms | ||
| setting 'xpack.security.http.ssl.enabled', 'true' | ||
| setting 'xpack.security.http.ssl.certificate', 'http-server.crt' | ||
| setting 'xpack.security.http.ssl.key', 'http-server.key' | ||
| setting 'xpack.security.http.ssl.key_passphrase', 'http-password' | ||
| setting 'xpack.security.http.ssl.client_authentication', 'optional' | ||
| setting 'xpack.security.http.ssl.certificate_authorities', 'http-client-ca.crt' | ||
|
|
||
| // Don't need transport SSL, so leave it out | ||
| setting 'xpack.security.transport.ssl.enabled', 'false' | ||
|
|
||
| // Configure every realm type | ||
| // - File | ||
| setting 'xpack.security.authc.realms.file.file0.order', '0' | ||
| // - Native | ||
| setting 'xpack.security.authc.realms.native.native1.order', '1' | ||
| // - LDAP (configured but won't work because we don't want external fixtures in this test suite) | ||
| setting 'xpack.security.authc.realms.ldap.ldap2.order', '2' | ||
| setting 'xpack.security.authc.realms.ldap.ldap2.url', 'ldap://localhost:7777' | ||
| setting 'xpack.security.authc.realms.ldap.ldap2.user_search.base_dn', 'OU=users,DC=example,DC=com' | ||
| // - AD (configured but won't work because we don't want external fixtures in this test suite) | ||
| setting 'xpack.security.authc.realms.active_directory.ad3.order', '3' | ||
| setting 'xpack.security.authc.realms.active_directory.ad3.domain_name', 'localhost' | ||
| // - PKI (works) | ||
| setting 'xpack.security.authc.realms.pki.pki4.order', '4' | ||
| // - SAML (configured but won't work because we don't want external fixtures in this test suite) | ||
| setting 'xpack.security.authc.realms.saml.saml5.order', '5' | ||
| setting 'xpack.security.authc.realms.saml.saml5.idp.metadata.path', 'saml-metadata.xml' | ||
| setting 'xpack.security.authc.realms.saml.saml5.idp.entity_id', 'http://idp.example.com/' | ||
| setting 'xpack.security.authc.realms.saml.saml5.sp.entity_id', 'http://kibana.example.net/' | ||
| setting 'xpack.security.authc.realms.saml.saml5.sp.acs', 'http://kibana.example.net/api/security/v1/saml' | ||
| setting 'xpack.security.authc.realms.saml.saml5.attributes.principal', 'uid' | ||
| // - Kerberos (configured but won't work because we don't want external fixtures in this test suite) | ||
| setting 'xpack.security.authc.realms.kerberos.kerb6.order', '6' | ||
| setting 'xpack.security.authc.realms.kerberos.kerb6.keytab.path', 'kerberos.keytab' | ||
| // - OIDC (configured but won't work because we don't want external fixtures in this test suite) | ||
| setting 'xpack.security.authc.realms.oidc.openid7.order', '7' | ||
| setting 'xpack.security.authc.realms.oidc.openid7.rp.client_id', 'http://rp.example.net' | ||
| setting 'xpack.security.authc.realms.oidc.openid7.rp.response_type', 'id_token' | ||
| setting 'xpack.security.authc.realms.oidc.openid7.rp.redirect_uri', 'https://kibana.example.net/api/security/v1/oidc' | ||
| setting 'xpack.security.authc.realms.oidc.openid7.op.issuer', 'https://op.example.com/' | ||
| setting 'xpack.security.authc.realms.oidc.openid7.op.authorization_endpoint', 'https://op.example.com/auth' | ||
| setting 'xpack.security.authc.realms.oidc.openid7.op.jwkset_path', 'oidc-jwkset.json' | ||
| setting 'xpack.security.authc.realms.oidc.openid7.claims.principal', 'sub' | ||
| keystore 'xpack.security.authc.realms.oidc.openid7.rp.client_secret', 'this-is-my-secret' | ||
|
|
||
| extraConfigFile 'roles.yml', file('src/javaRestTest/resources/roles.yml') | ||
| user username: "admin_user", password: "admin-password" | ||
| user username: "security_test_user", password: "security-test-password", role: "security_test_role" | ||
| } | ||
|
|
38 changes: 38 additions & 0 deletions
38
...-realms/src/javaRestTest/java/org/elasticsearch/xpack/security/authc/FileRealmAuthIT.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License | ||
| * 2.0; you may not use this file except in compliance with the Elastic License | ||
| * 2.0. | ||
| */ | ||
|
|
||
| package org.elasticsearch.xpack.security.authc; | ||
|
|
||
| import org.elasticsearch.client.RequestOptions; | ||
| import org.elasticsearch.common.settings.SecureString; | ||
| import org.elasticsearch.xpack.core.security.authc.support.UsernamePasswordToken; | ||
|
|
||
| import java.io.IOException; | ||
| import java.util.Map; | ||
|
|
||
| /** | ||
| * Integration Rest Test for testing authentication when all possible realms are configured | ||
| */ | ||
| public class FileRealmAuthIT extends SecurityRealmSmokeTestCase { | ||
|
|
||
| // Declared in build.gradle | ||
| private static final String USERNAME = "security_test_user"; | ||
| private static final SecureString PASSWORD = new SecureString("security-test-password".toCharArray()); | ||
| private static final String ROLE_NAME = "security_test_role"; | ||
|
|
||
| public void testAuthenticationUsingFileRealm() throws IOException { | ||
| Map<String, Object> authenticate = super.authenticate( | ||
| RequestOptions.DEFAULT.toBuilder().addHeader("Authorization", | ||
| UsernamePasswordToken.basicAuthHeaderValue(USERNAME, PASSWORD)) | ||
| ); | ||
|
|
||
| assertUsername(authenticate, USERNAME); | ||
| assertRealm(authenticate, "file", "file0"); | ||
| assertRoles(authenticate, ROLE_NAME); | ||
| } | ||
|
|
||
| } |
52 changes: 52 additions & 0 deletions
52
...ealms/src/javaRestTest/java/org/elasticsearch/xpack/security/authc/NativeRealmAuthIT.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License | ||
| * 2.0; you may not use this file except in compliance with the Elastic License | ||
| * 2.0. | ||
| */ | ||
|
|
||
| package org.elasticsearch.xpack.security.authc; | ||
|
|
||
| import org.elasticsearch.client.RequestOptions; | ||
| import org.elasticsearch.common.settings.SecureString; | ||
| import org.elasticsearch.xpack.core.security.authc.support.UsernamePasswordToken; | ||
| import org.junit.After; | ||
| import org.junit.Before; | ||
|
|
||
| import java.io.IOException; | ||
| import java.util.Collections; | ||
| import java.util.Map; | ||
|
|
||
| /** | ||
| * Integration Rest Test for testing authentication when all possible realms are configured | ||
| */ | ||
| public class NativeRealmAuthIT extends SecurityRealmSmokeTestCase { | ||
|
|
||
| private static final String USERNAME = "test_native_user"; | ||
| private static final SecureString PASSWORD = new SecureString("native-user-password".toCharArray()); | ||
| private static final String ROLE_NAME = "native_role"; | ||
|
|
||
| @Before | ||
| public void createUsersAndRoles() throws IOException { | ||
| createUser(USERNAME, PASSWORD, Collections.singletonList(ROLE_NAME)); | ||
| createRole("native_role", Collections.singleton("monitor")); | ||
| } | ||
|
|
||
| @After | ||
| public void cleanUp() throws IOException { | ||
| deleteUser(USERNAME); | ||
| deleteRole(ROLE_NAME); | ||
| } | ||
|
|
||
| public void testAuthenticationUsingNativeRealm() throws IOException { | ||
| Map<String, Object> authenticate = super.authenticate( | ||
| RequestOptions.DEFAULT.toBuilder().addHeader("Authorization", | ||
| UsernamePasswordToken.basicAuthHeaderValue(USERNAME, PASSWORD)) | ||
| ); | ||
|
|
||
| assertUsername(authenticate, USERNAME); | ||
| assertRealm(authenticate, "native", "native1"); | ||
| assertRoles(authenticate, ROLE_NAME); | ||
| } | ||
|
|
||
| } |
44 changes: 44 additions & 0 deletions
44
...l-realms/src/javaRestTest/java/org/elasticsearch/xpack/security/authc/PkiRealmAuthIT.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License | ||
| * 2.0; you may not use this file except in compliance with the Elastic License | ||
| * 2.0. | ||
| */ | ||
|
|
||
| package org.elasticsearch.xpack.security.authc; | ||
|
|
||
| import org.elasticsearch.client.RequestOptions; | ||
| import org.elasticsearch.common.settings.Settings; | ||
| import org.elasticsearch.common.util.concurrent.ThreadContext; | ||
|
|
||
| import java.io.IOException; | ||
| import java.util.Map; | ||
|
|
||
| /** | ||
| * Integration Rest Test for testing authentication when all possible realms are configured | ||
| */ | ||
| public class PkiRealmAuthIT extends SecurityRealmSmokeTestCase { | ||
|
|
||
| // Derived from certificate attributes (pki-auth.crt) | ||
| private static final String USERNAME = "pki-auth"; | ||
|
|
||
| @Override | ||
| protected Settings restClientSettings() { | ||
| Settings.Builder builder = Settings.builder() | ||
| .put(super.restClientSettings()) | ||
| .put(CLIENT_CERT_PATH, getDataPath("/ssl/pki-auth.crt")) | ||
| .put(CLIENT_KEY_PATH, getDataPath("/ssl/pki-auth.key")) | ||
| .put(CLIENT_KEY_PASSWORD, "http-password"); | ||
| builder.remove(ThreadContext.PREFIX + ".Authorization"); | ||
| return builder.build(); | ||
| } | ||
|
|
||
| public void testAuthenticationUsingFileRealm() throws IOException { | ||
| Map<String, Object> authenticate = super.authenticate(RequestOptions.DEFAULT.toBuilder()); | ||
|
|
||
| assertUsername(authenticate, USERNAME); | ||
| assertRealm(authenticate, "pki", "pki4"); | ||
| assertRoles(authenticate, new String[0]); | ||
| } | ||
|
|
||
| } |
36 changes: 36 additions & 0 deletions
36
...-all-realms/src/javaRestTest/java/org/elasticsearch/xpack/security/authc/RealmInfoIT.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License | ||
| * 2.0; you may not use this file except in compliance with the Elastic License | ||
| * 2.0. | ||
| */ | ||
|
|
||
| package org.elasticsearch.xpack.security.authc; | ||
|
|
||
| import org.elasticsearch.client.Request; | ||
| import org.elasticsearch.client.Response; | ||
| import org.elasticsearch.test.rest.yaml.ObjectPath; | ||
| import org.hamcrest.Matchers; | ||
|
|
||
| import java.io.IOException; | ||
| import java.util.Map; | ||
|
|
||
| /** | ||
| * Integration Rest Test for testing authentication when all possible realms are configured | ||
| */ | ||
| public class RealmInfoIT extends SecurityRealmSmokeTestCase { | ||
|
|
||
| public void testThatAllRealmTypesAreEnabled() throws IOException { | ||
| final Request request = new Request("GET", "_xpack/usage"); | ||
| final Response response = client().performRequest(request); | ||
| Map<String, Object> usage = entityAsMap(response); | ||
|
|
||
| Map<String, Object> realms = ObjectPath.evaluate(usage, "security.realms"); | ||
| realms.forEach((type, config) -> { | ||
| assertThat(config, Matchers.instanceOf(Map.class)); | ||
| assertThat("Realm type [" + type + "] is not enabled", | ||
| ((Map<?, ?>) config).get("enabled"), Matchers.equalTo(true)); | ||
| }); | ||
| } | ||
|
|
||
| } |
Oops, something went wrong.