[ftr] move SAML auth to kbn-test #172678

dmlemeshko · 2023-12-06T13:33:56Z

Summary

This PR moves SAML session creation from FTR service to @kbn/test. It should simplify its adoption in non-FTR context, e.g. Cypress tests or jest integration tests:

import { SamlSessionManager } from '@kbn/test';

// create instance in your setup file
const sessionManager = new SamlSessionManager({
  hostOptions: {
    protocol,
    hostname,
    port,
    username,
    password,
  },
  log,
  isCloud
});

use it in your tests

sessionManager.getSessionCookieForRole('viewer');

…fix'

…to-kbn-test

…o/kibana into ftr/move-saml-auth-to-kbn-test

…-fix'

dmlemeshko · 2023-12-06T17:17:17Z

x-pack/test_serverless/shared/services/svl_user_manager.ts

+  const log = getService('log');
+  const isCloud = !!process.env.TEST_CLOUD;
+  // Sharing the instance within FTR config run means cookies are persistent for each role between tests.
+  const sessionManager = new SAMLSessionManager(config, log, isCloud);


I'm not sure if Cypress test runner has access to config instance, so I imagine a possible alternative like:

new SAMLSessionManager(kbnHost, auth, log, isCloud)

where kbnHost and auth FTR and Cypress runner should provide on its own:

const kbnHost = { protocol: config.get('servers.kibana.protocol'), hostname: config.get('servers.kibana.hostname'), port: isCloud ? undefined : config.get('servers.kibana.port'), }; const auth = { username: config.get('servers.kibana.username')}, password: config.get('servers.kibana.password') }

@MadameSheema @pheyos wdyt?

I believe the alternative is the best one for Cypress usage. Thanks :)

Changed in 82f750b

pheyos · 2023-12-06T17:21:46Z

packages/kbn-test/src/auth/session_manager.ts

+  // getLocalUsers = () => {
+  //   const rolesDefinitionFilePath = resolve(
+  //     REPO_ROOT,
+  //     'packages/kbn-es/src/serverless_resources/roles.yml'
+  //   );
+  //   const roles: string[] = Object.keys(loadYaml(fs.readFileSync(rolesDefinitionFilePath, 'utf8')));
+  // };


Is this commented out intentionally?

I was thinking to split packages/kbn-es/src/serverless_resources/roles.yml into 3 files and read as part of role validation when we run tests locally. But I will do it later to not keep PR open for long

Note: Currently folks can specify non-existing role in the test and I believe tests will pass locally/Kibana CI. But it will fail on MKI pipeline since that role does not exist in real Cloud env.

…o/kibana into ftr/move-saml-auth-to-kbn-test

…uth-to-kbn-test

…-fix'

azasypkin · 2023-12-07T15:34:02Z

x-pack/test_serverless/shared/services/svl_user_manager.ts

+      username: config.get('servers.kibana.username'),
+      password: config.get('servers.kibana.password'),


question: just for my understanding: what are these credentials for?

@azasypkin it turns out we need to create instance of KbnClient to fetch Kibana version and for cloud we pass credentials to the client.

azasypkin

LGTM, thanks!

packages/kbn-test/src/auth/session_manager.ts

azasypkin · 2023-12-07T15:40:40Z

packages/kbn-test/src/auth/helper.ts

+import * as fs from 'fs';
+import { User } from './session_manager';
+
+export const getProjectType = (serverArgs: string[]) => {


question: I see this function isn't used anywhere yet, is it just a leftover or is it reserved for some future use?

I remove it in fac981e. Originally I planned to split svl roles yml into 3 files and validate roles per project, but decided to move it to the follow-up PR.

…o/kibana into ftr/move-saml-auth-to-kbn-test

…to-kbn-test

Co-authored-by: Aleh Zasypkin <[email protected]>

…o/kibana into ftr/move-saml-auth-to-kbn-test

…to-kbn-test

…-fix'

kibana-ci · 2023-12-08T00:32:43Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: c4ead20

Failed CI Steps

FTR Configs #38

Test Failures

[job] [logs] FTR Configs #38 / Rule execution logic API Execution logic @ess @serverless Query type rules should query and get back expected alert structure when it is a alert on a alert

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`@kbn/test`	244	262	+18

Unknown metric groups

API count

id	before	after	diff
`@kbn/test`	291	310	+19

History

💛 Build #182383 was flaky 3f46466
💛 Build #182206 was flaky d217a4c
💛 Build #182149 was flaky cdbf959

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@dkirchan

…ing (#172655) Relates to: * #166340 * #170852 * #170417 * #172678 ## Summary In this PR we are using the code implemented on #170417 and #172678 to allow SAML and role testing inside Cypress. * We are creating a Cypress task to use the above-developed code and be able to retrieve a session cookie given a role. * We updated the login task to know how we should perform the login depending if we are in Serverless (MKI or serverless FTR) or ESS * In the parallel serverless script: * We are updating the `BASE_ENV_URL` variable to use the proper QA environment (pending to be done in follow-up PRs, to extract this value so it is not hardcoded cc @dkirchan ) * We are adding the `IS_SERVERLESS` environment variable needed for the logic on the login task. This changed implied to update the `es_archiver` file to continue work as expected. * We have added the `TEST_CLOUD_HOST_NAME` environment variable needed for the code we are reusing to retrieve the session cookie for MKI. * We have updated the Security Solution quality gate script to set the `role_users.json` file needed by the code we are reusing to get the different session cookies on MKI * We have adjusted the tests because the username now follows the pattern `test <role>` (@dmlemeshko is it possible to have as username just the role? Is this something that can impact other tests and teams?) * We have [skipped](#173168) a test that got unstable after the changes. ## How to test it in your machine ### Serverless FTR 1. Navigate to `x-pack/test/security_solution_cypress` 2. Execute `yarn cypress:open:qa:serverless` 3. Click on `E2E testing` 4. Click on any test to execute it ### Serverless MKI Setup a valid Elastic Cloud API key for QA environment: 1. Navigate to QA environment. 2. Click on the `User menu button` located on the top right of the header. 3. Click on `Organization`. 5. Click on the `API keys` tab. 6. Click on `Create API key` button. 7. Add a name, set an expiration date, assign an organization owner role. 8. Click on `Create API key` 9. Save the value of the key Store the saved key on `~/.elastic/cloud.json` using the following format: ```json { "api_key": { "qa": "<API_KEY>" } } ``` Store the email and password of the account you used to login in the QA Environment at the root directory of your Kibana project on `.ftr/role_users.json`, using the following format: ```json { "admin": { "email": "<email>", "password": "<password>" } } ``` If you want to execute a test with a role different from the default one, make sure you have created the user under your organization and is added to the above json following the format: ```json { "admin": { "email": "<email>", "password": "<password>" }, "<roleName>": { "email": "<email>", "password": "<password>" } } ``` 1. Navigate to `x-pack/test/security_solution_cypress` 2. Execute `yarn cypress:open:qa:serverless` 3. Click on `E2E testing` 4. Click on any test to execute it --------- Co-authored-by: kibanamachine <[email protected]>

dmlemeshko and others added 7 commits December 6, 2023 14:25

[ftr] move SAML auth to kbn-test

bf8c7f9

fetch kibana version only for cloud saml session

3ecba70

[CI] Auto-commit changed files from 'node scripts/lint_ts_projects --…

cdbf959

…fix'

revert local prettier change

30a9fa1

Merge remote-tracking branch 'upstream/main' into ftr/move-saml-auth-…

b931c6c

…to-kbn-test

Merge branch 'ftr/move-saml-auth-to-kbn-test' of github.com:dmlemeshk…

09f7893

…o/kibana into ftr/move-saml-auth-to-kbn-test

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

d217a4c

…-fix'

pheyos mentioned this pull request Dec 6, 2023

[Security Solution] [Cypress] SAML for Serverless login and role testing #172655

Merged

dmlemeshko commented Dec 6, 2023

View reviewed changes

pheyos reviewed Dec 6, 2023

View reviewed changes

dmlemeshko added 3 commits December 7, 2023 09:41

change interface to not rely on FTR config

82f750b

Merge branch 'ftr/move-saml-auth-to-kbn-test' of github.com:dmlemeshk…

eaf24d6

…o/kibana into ftr/move-saml-auth-to-kbn-test

Merge branch 'main' of github.com:elastic/kibana into ftr/move-saml-a…

740ab77

…uth-to-kbn-test

dmlemeshko requested a review from azasypkin December 7, 2023 08:52

kibanamachine and others added 2 commits December 7, 2023 09:25

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

3f46466

…-fix'

clean code

fac981e

azasypkin reviewed Dec 7, 2023

View reviewed changes

azasypkin approved these changes Dec 7, 2023

View reviewed changes

dmlemeshko and others added 4 commits December 7, 2023 18:35

add unit tests

7ef742e

Merge branch 'ftr/move-saml-auth-to-kbn-test' of github.com:dmlemeshk…

692b618

…o/kibana into ftr/move-saml-auth-to-kbn-test

Merge remote-tracking branch 'upstream/main' into ftr/move-saml-auth-…

27afd47

…to-kbn-test

Update packages/kbn-test/src/auth/session_manager.ts

63537f9

Co-authored-by: Aleh Zasypkin <[email protected]>

dmlemeshko added release_note:skip Skip the PR/issue when compiling release notes backport:skip This commit does not require backporting v8.13.0 labels Dec 7, 2023

dmlemeshko marked this pull request as ready for review December 7, 2023 17:41

dmlemeshko requested review from a team as code owners December 7, 2023 17:41

dmlemeshko requested a review from pheyos December 7, 2023 17:41

jbudz approved these changes Dec 7, 2023

View reviewed changes

dmlemeshko added 4 commits December 7, 2023 23:26

update tests

568d02a

Merge branch 'ftr/move-saml-auth-to-kbn-test' of github.com:dmlemeshk…

2ece8e7

…o/kibana into ftr/move-saml-auth-to-kbn-test

update api integration test example

93664d5

Merge remote-tracking branch 'upstream/main' into ftr/move-saml-auth-…

405dde8

…to-kbn-test

dmlemeshko enabled auto-merge (squash) December 7, 2023 22:43

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

c4ead20

…-fix'

dmlemeshko merged commit a4a0ad7 into elastic:main Dec 8, 2023
38 checks passed

dmlemeshko self-assigned this Dec 8, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[ftr] move SAML auth to kbn-test #172678

[ftr] move SAML auth to kbn-test #172678

dmlemeshko commented Dec 6, 2023 •

edited

Loading

dmlemeshko Dec 6, 2023 •

edited

Loading

MadameSheema Dec 6, 2023

dmlemeshko Dec 7, 2023

pheyos Dec 6, 2023

dmlemeshko Dec 7, 2023

dmlemeshko Dec 7, 2023 •

edited

Loading

azasypkin Dec 7, 2023

dmlemeshko Dec 7, 2023

azasypkin left a comment

azasypkin Dec 7, 2023

dmlemeshko Dec 7, 2023

kibana-ci commented Dec 8, 2023

API count

		username: config.get('servers.kibana.username'),
		password: config.get('servers.kibana.password'),

[ftr] move SAML auth to kbn-test #172678

[ftr] move SAML auth to kbn-test #172678

Conversation

dmlemeshko commented Dec 6, 2023 • edited Loading

Summary

dmlemeshko Dec 6, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dmlemeshko Dec 7, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

azasypkin left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kibana-ci commented Dec 8, 2023

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Public APIs missing comments

API count

History

dmlemeshko commented Dec 6, 2023 •

edited

Loading

dmlemeshko Dec 6, 2023 •

edited

Loading

dmlemeshko Dec 7, 2023 •

edited

Loading