SimpleKdcLdapServerTests.testPrincipalCreationAndSearchOnLdap fails sporadically #32739
Assignees
Labels
:Security/Authentication
Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc)
>test-failure
Triaged test failures from CI
v7.0.0-beta1
Comments
alpar-t
added
>test-failure
|
@bizybot can you please track down this failure? |
jaymode
added
the
:Security/Authentication
|
Pinging @elastic/es-security |
bizybot
pushed a commit
to bizybot/elasticsearch
that referenced
this issue
Aug 27, 2018
The test SimpleKdcLdapServerTests#testPrincipalCreationAndSearchOnLdap fails intermittently and I could not reproduce this locally. There were two exceptions from the console logs of which one might be the reason for the failure. When simple kdc ldap server starts, internally it starts kdc server and ldap server. Kdc server then tries to connect to configured ldap backend and during this process it waits for the connection to succeed, meanwhile checking for deadlocks in between. During this deadlock check it needs permission to `accessClassInPackage.sun.reflect`, the fix here is to add the required permission so that the check does not throw exception. I think once we fix this issue, we may have something to look forward if there is indeed a deadlock or its just waiting for the process to complete on slow test runs. Added a null check in after test method. See elastic#32739
|
I am in process of moving these tests to evil-tests as it needs some permission which we do not want to enable on production. |
bizybot
referenced
this issue
in bizybot/elasticsearch
Sep 7, 2018
We have a test dependency on Apache Mina when using SimpleKdcServer for testing Kerberos. When checking for ldap backend connectivity, the code checks for deadlocks which require additional security permissions `accessClassInPackage.sun.reflect`. As this is only for test and we do not want to add security permissions to production, this commit moves these tests and related classes to x-pack evil-tests where they can run with security manager disabled. The plan is to handle the security manager exception in the upstream and then once the release is available run these tests with security manager enabled. Closes#32739
bizybot
added a commit
that referenced
this issue
Sep 14, 2018
We have a test dependency on Apache Mina when using SimpleKdcServer for testing Kerberos. When checking for LDAP backend connectivity, the code checks for deadlocks which require additional security permissions accessClassInPackage.sun.reflect. As this is only for test and we do not want to add security permissions to production, this commit moves these tests and related classes to x-pack evil-tests where they can run with security manager disabled. The plan is to handle the security manager exception in the upstream issue DIRMINA-1093 and then once the release is available to run these tests with security manager enabled. Closes #32739
bizybot
added a commit
to bizybot/elasticsearch
that referenced
this issue
Sep 14, 2018
We have a test dependency on Apache Mina when using SimpleKdcServer for testing Kerberos. When checking for LDAP backend connectivity, the code checks for deadlocks which require additional security permissions accessClassInPackage.sun.reflect. As this is only for test and we do not want to add security permissions to production, this commit moves these tests and related classes to x-pack evil-tests where they can run with security manager disabled. The plan is to handle the security manager exception in the upstream issue DIRMINA-1093 and then once the release is available to run these tests with security manager enabled. Closes elastic#32739
|
We have another test failure on the 6.4 branch in https://elasticsearch-ci.elastic.co/job/elastic+elasticsearch+6.4+matrix-java-periodic/ES_BUILD_JAVA=java10,ES_RUNTIME_JAVA=java8fips,nodes=virtual&&linux/57/consoleFull and I think this is the same error: I attempted to cherry-pick your changes to 6.4 but it does not apply cleanly. Can you please backport this to 6.4 @bizybot as you are probably more familiar with the changes than me? Thank you! |
bizybot
added a commit
that referenced
this issue
Oct 16, 2018
We have a test dependency on Apache Mina when using SimpleKdcServer for testing Kerberos. When checking for LDAP backend connectivity, the code checks for deadlocks which require additional security permissions accessClassInPackage.sun.reflect. As this is only for test and we do not want to add security permissions to production, this commit moves these tests and related classes to x-pack evil-tests where they can run with security manager disabled. The plan is to handle the security manager exception in the upstream issue DIRMINA-1093 and then once the release is available to run these tests with security manager enabled. Closes #32739
|
Backported change to 6.4 (move SimpleKdc to evil-tests), closing this issue. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Logs: https://elasticsearch-ci.elastic.co/job/elastic+elasticsearch+master+matrix-java-periodic/ES_BUILD_JAVA=java10,ES_RUNTIME_JAVA=java8,nodes=virtual&&linux/226/console
https://elasticsearch-ci.elastic.co/job/elastic+elasticsearch+6.x+periodic/2514/console
reproduction line (does not reproduce locally), failed once before on August 3 on the ccr branhc in CI.
Relevant logs:
The text was updated successfully, but these errors were encountered: