[Security Solution] [Cypress] SAML for Serverless login and role testing

x-pack/test/security_solution_cypress/cypress/cypress.config.ts

@@ -7,6 +7,7 @@
 
 import { defineCypressConfig } from '@kbn/cypress-config';
 import { esArchiver } from './support/es_archiver';
+import { samlAuthentication } from './support/saml_auth';
 
 export default defineCypressConfig({
   defaultCommandTimeout: 60000,
@@ -30,6 +31,7 @@ export default defineCypressConfig({
     experimentalCspAllowList: ['default-src', 'script-src', 'script-src-elem'],
     setupNodeEvents(on, config) {
       esArchiver(on, config);
+      samlAuthentication(on, config);
       // eslint-disable-next-line @typescript-eslint/no-var-requires
       require('@cypress/grep/src/plugin')(config);
       return config;

x-pack/test/security_solution_cypress/cypress/cypress_ci.config.ts

@@ -7,6 +7,7 @@
 
 import { defineCypressConfig } from '@kbn/cypress-config';
 import { esArchiver } from './support/es_archiver';
+import { samlAuthentication } from './support/saml_auth';
 
 // eslint-disable-next-line import/no-default-export
 export default defineCypressConfig({
@@ -39,6 +40,7 @@ export default defineCypressConfig({
     specPattern: './cypress/e2e/**/*.cy.ts',
     setupNodeEvents(on, config) {
       esArchiver(on, config);
+      samlAuthentication(on, config);
       // eslint-disable-next-line @typescript-eslint/no-var-requires
       require('@cypress/grep/src/plugin')(config);
       return config;

x-pack/test/security_solution_cypress/cypress/cypress_ci_serverless.config.ts

@@ -7,6 +7,7 @@
 
 import { defineCypressConfig } from '@kbn/cypress-config';
 import { esArchiver } from './support/es_archiver';
+import { samlAuthentication } from './support/saml_auth';
 
 // eslint-disable-next-line import/no-default-export
 export default defineCypressConfig({
@@ -39,6 +40,7 @@ export default defineCypressConfig({
     specPattern: './cypress/e2e/**/*.cy.ts',
     setupNodeEvents(on, config) {
       esArchiver(on, config);
+      samlAuthentication(on, config);
       // eslint-disable-next-line @typescript-eslint/no-var-requires
       require('@cypress/grep/src/plugin')(config);
       return config;

x-pack/test/security_solution_cypress/cypress/cypress_ci_serverless_qa.config.ts

@@ -7,6 +7,7 @@
 
 import { defineCypressConfig } from '@kbn/cypress-config';
 import { esArchiver } from './support/es_archiver';
+import { samlAuthentication } from './support/saml_auth';
 
 // eslint-disable-next-line import/no-default-export
 export default defineCypressConfig({
@@ -41,6 +42,7 @@ export default defineCypressConfig({
     specPattern: './cypress/e2e/**/*.cy.ts',
     setupNodeEvents(on, config) {
       esArchiver(on, config);
+      samlAuthentication(on, config);
       process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
       // eslint-disable-next-line @typescript-eslint/no-var-requires
       require('@cypress/grep/src/plugin')(config);

x-pack/test/security_solution_cypress/cypress/cypress_serverless.config.ts

@@ -7,6 +7,7 @@
 
 import { defineCypressConfig } from '@kbn/cypress-config';
 import { esArchiver } from './support/es_archiver';
+import { samlAuthentication } from './support/saml_auth';
 
 // eslint-disable-next-line import/no-default-export
 export default defineCypressConfig({
@@ -31,6 +32,7 @@ export default defineCypressConfig({
     experimentalMemoryManagement: true,
     setupNodeEvents(on, config) {
       esArchiver(on, config);
+      samlAuthentication(on, config);
       // eslint-disable-next-line @typescript-eslint/no-var-requires
       require('@cypress/grep/src/plugin')(config);
       return config;

x-pack/test/security_solution_cypress/cypress/support/saml_auth.ts

@@ -0,0 +1,81 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ToolingLog } from '@kbn/tooling-log';
+import { REPO_ROOT } from '@kbn/repo-info';
+import { resolve } from 'path';
+
+import axios from 'axios';
+
+import * as fs from 'fs';
+
+import { SecurityRoleName } from '@kbn/security-solution-plugin/common/test';
+import { User } from '../../../../test_serverless/shared/services/user_manager/svl_user_manager';
+import {
+  createCloudSAMLSession,
+  CloudSamlSessionParams,
+  LocalSamlSessionParams,
+  createLocalSAMLSession,
+} from '../../../../test_serverless/shared/services/user_manager/saml_auth';
+
+export const samlAuthentication = async (
+  on: Cypress.PluginEvents,
+  config: Cypress.PluginConfigOptions
+): Promise<void> => {
+  const log = new ToolingLog({ level: 'verbose', writeTo: process.stdout });
+
+  const kbnHost = config.env.KIBANA_URL || config.env.BASE_URL;
+
+  const auth = btoa(`${config.env.ELASTICSEARCH_USERNAME}:${config.env.ELASTICSEARCH_PASSWORD}`);
+
+  const response = await axios.get(`${kbnHost}/api/status`, {
+    headers: {
+      Authorization: `Basic ${auth}`,
+    },
+  });
+  const kbnVersion = response.data.version.number;
+
+  const cloudRoleUsersFilePath = resolve(REPO_ROOT, '.ftr', 'role_users.json');
+
+  const roleToUserMap: Map<string, User> = new Map<string, User>();
+
+  const getCloudUserByRole = (role: string) => {
+    const data = fs.readFileSync(cloudRoleUsersFilePath, 'utf8');
+    if (data.length === 0) {
+      throw new Error(`'${cloudRoleUsersFilePath}' is empty: no roles are defined`);
+    }
+    for (const [roleName, user] of Object.entries(JSON.parse(data)) as Array<[string, User]>) {
+      roleToUserMap.set(roleName, user);
+    }
+    return roleToUserMap.get(role)!;
+  };
+
+  on('task', {
+    createCloudSAMLSession: async (role: string | SecurityRoleName): Promise<string> => {
+      const samlSessionParams: CloudSamlSessionParams = {
+        ...getCloudUserByRole(role),
+        kbnHost,
+        kbnVersion,
+        log,
+      };
+      const session = await createCloudSAMLSession(samlSessionParams);
+      return session.getCookieValue();
+    },
+    createLocalSAMLSession: async (role: string | SecurityRoleName): Promise<string> => {
+      const localSamlSessionParams: LocalSamlSessionParams = {
+        username: role,
+        email: `${role}@elastic.co`,
+        fullname: role,
+        role,
+        kbnHost,
+        log,
+      };
+      const session = await createLocalSAMLSession(localSamlSessionParams);
+      return session.getCookieValue();
+    },
+  });
+};

x-pack/test/security_solution_cypress/cypress/support/setup_users.ts

@@ -39,7 +39,7 @@ function createUser(username: string, password: string, roles: string[] = []): v
     password,
     roles,
     full_name: username,
-    email: '',
+    email: `${username}@elastic.co`,
   };
 
   rootRequest({

x-pack/test/security_solution_cypress/cypress/tasks/login.ts

@@ -41,8 +41,29 @@ export const getEnvAuth = (role: SecurityRoleName): User => {
 };
 
 export const login = (role?: SecurityRoleName): void => {
-  const user = role ? getEnvAuth(role) : defaultUser;
-  loginWithUser(user);
+  let testRole = '';
+
+  if (IS_SERVERLESS) {
+    if (!role) {
+      testRole = Cypress.env(CLOUD_SERVERLESS) ? 'admin' : 'system_indices_superuser';
+    } else {
+      testRole = role;
+    }
+    const task = Cypress.env(CLOUD_SERVERLESS)
+      ? 'createCloudSAMLSession'
+      : 'createLocalSAMLSession';
+
+    cy.task(task, testRole).then((cookie) => {
+      cy.setCookie('sid', cookie as string);
+    });
+
+    if (Cypress.env(CLOUD_SERVERLESS)) {
+      cy.visit('/');
+    }
+  } else {
+    const user = role ? getEnvAuth(role) : defaultUser;
+    loginWithUser(user);
+  }
 };
 
 export const loginWithUser = (user: User): void => {

x-pack/test/security_solution_cypress/cypress/tsconfig.json

@@ -40,6 +40,7 @@
     "@kbn/management-settings-ids",
     "@kbn/es-query",
     "@kbn/ml-plugin",
-    "@kbn/license-management-plugin"
+    "@kbn/license-management-plugin",
+    "@kbn/repo-info"
   ]
 }