[FTR] support custom native roles in serverless tests by dmlemeshko · Pull Request #194677 · elastic/kibana

dmlemeshko · 2024-10-02T09:58:07Z

Summary

This PR updates FTR services to support authentication with custom native role. Few notes:

for compatibility with MKI we reserve "customRole" as a custom role name used in tests
test user is automatically assigned to this role, but before login in browser/ generating cookie header or API key in each test suite role privileges must me updated according test scenario

How to test:
I added a new test file for Search project: x-pack/test_serverless/functional/test_suites/search/custom_role_access.ts

It can be run locally with:

 node scripts/functional_tests --config=x-pack/test_serverless/functional/test_suites/search/config.ts --grep "With custom role"

FTR UI test example:

// First set privileges for custom role
await samlAuth.setCustomRole({
        elasticsearch: {
          indices: [{ names: ['logstash-*'], privileges: ['read', 'view_index_metadata'] }],
        },
        kibana: [
          {
            feature: {
              discover: ['read'],
            },
            spaces: ['*'],
          },
        ],
      });
    });

// Then you can login in browser as a user with newly defined privileges
await pageObjects.svlCommonPage.loginWithCustomRole();

FTR api_integration test example:

// First set privileges for custom role
await samlAuth.setCustomRole({
        elasticsearch: {
          indices: [{ names: ['logstash-*'], privileges: ['read', 'view_index_metadata'] }],
        },
        kibana: [
          {
            feature: {
              discover: ['read'],
            },
            spaces: ['*'],
          },
        ],
      });
    });
// Then you can generate an API key with newly defined privileges
const roleAuthc = await samlAuth.createM2mApiKeyWithRoleScope('customRole');
// Don't forget to invalidate the API key in the end
await samlAuth.invalidateM2mApiKeyWithRoleScope(roleAuthc);

…native-roles

dmlemeshko · 2024-10-02T14:35:40Z

packages/kbn-ftr-common-functional-services/services/saml_auth/saml_auth_provider.ts

+      ...(role === CUSTOM_ROLE
+        ? { kibana_role_descriptors: roleDescriptors }
+        : { role_descriptors: roleDescriptors }),


I was getting 400 status code while trying to send payload with role_descriptors for custom role. I searched in Kibana repo for some code examples and found schema validation for kibana_role_description https://github.com/elastic/kibana/blob/main/x-pack/packages/security/plugin_types_server/src/authentication/api_keys/api_keys.ts#L29-L36

Would be good if @jeramysoucy or @azasypkin can confirm I'm doing it correctly

…ko/kibana into ftr/support-custom-native-roles

…native-roles

…ko/kibana into ftr/support-custom-native-roles

dmlemeshko · 2024-10-04T11:38:35Z

x-pack/test_serverless/api_integration/test_suites/common/platform_security/authorization.ts

+      // skipped, see https://github.com/elastic/kibana/issues/194933
+      describe.skip('disabled', () => {


@elastic/kibana-security This suite is failing because APIs are no longer disabled, I opened #194933 to track test migration from feature flag config to the regular one.

Will be resolved by #195584

jeramysoucy

Looks great, Dima! Just left some informational comments.

jeramysoucy · 2024-10-11T09:42:50Z

x-pack/test_serverless/api_integration/config.base.ts

+          // custom native roles are enabled only for search and security projects
+          ...(options.serverlessProject !== 'oblt'
+            ? ['--xpack.security.roleManagementEnabled=true']
+            : []),


Just leaving myself a note that this (an equivalent in functional and agnostic test configs) can be removed once #195584 is merged.

jeramysoucy · 2024-10-11T09:43:33Z

x-pack/test_serverless/api_integration/test_suites/common/platform_security/authorization.ts

+      // skipped, see https://github.com/elastic/kibana/issues/194933
+      describe.skip('disabled', () => {


Will be resolved by #195584

jeramysoucy · 2024-10-11T09:50:27Z

x-pack/test_serverless/functional/test_suites/search/custom_role_access.ts

+    });
+
+    it('should login successfully', async () => {
+      await pageObjects.svlCommonPage.loginWithCustomRole();


Nit: are the following two test cases are dependent on this one? Could move login to the before block, or duplicate in the following cases.

good point, I will update it.

elasticmachine · 2024-10-11T14:06:29Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: c6c4b32

Failed CI Steps

Checks

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`@kbn/ftr-common-functional-services`	83	86	+3

Any counts in public APIs

Total count of every any typed public API. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats any for more detailed information.

id	before	after	diff
`@kbn/ftr-common-functional-services`	0	2	+2

Unknown metric groups

API count

id	before	after	diff
`@kbn/ftr-common-functional-services`	108	111	+3

History

💔 Build #241534 failed 7b57978
💚 Build #240759 succeeded 403ea84
💔 Build #240603 failed a8243e9
💔 Build #240422 failed 472d30f

pheyos

LGTM

kibanamachine · 2024-10-11T15:11:42Z

Starting backport for target branches: 8.x

https://github.com/elastic/kibana/actions/runs/11294823185

kibanamachine · 2024-10-11T15:16:19Z

💔 All backports failed

Status	Branch	Result
❌	8.x	Backport failed because of merge conflicts You might need to backport the following PRs to 8.x: - Set spaces and roles CRUD APIs to public (#193534)

Manual backport

To create the backport manually run:

node scripts/backport --pr 194677

Questions ?

Please refer to the Backport tool documentation

dmlemeshko · 2024-10-15T15:30:50Z

💚 All backports created successfully

Status	Branch	Result
✅	8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

## Summary This PR updates FTR services to support authentication with custom native role. Few notes: - for compatibility with MKI we reserve **"customRole"** as a custom role name used in tests - test user is **automatically assigned** to this role, but before login in browser/ generating cookie header or API key in each test suite **role privileges must me updated according test scenario** How to test: I added a new test file for Search project: `x-pack/test_serverless/functional/test_suites/search/custom_role_access.ts` It can be run locally with: ``` node scripts/functional_tests --config=x-pack/test_serverless/functional/test_suites/search/config.ts --grep "With custom role" ``` FTR UI test example: ```ts // First set privileges for custom role await samlAuth.setCustomRole({ elasticsearch: { indices: [{ names: ['logstash-*'], privileges: ['read', 'view_index_metadata'] }], }, kibana: [ { feature: { discover: ['read'], }, spaces: ['*'], }, ], }); }); // Then you can login in browser as a user with newly defined privileges await pageObjects.svlCommonPage.loginWithCustomRole(); ``` FTR api_integration test example: ```ts // First set privileges for custom role await samlAuth.setCustomRole({ elasticsearch: { indices: [{ names: ['logstash-*'], privileges: ['read', 'view_index_metadata'] }], }, kibana: [ { feature: { discover: ['read'], }, spaces: ['*'], }, ], }); }); // Then you can generate an API key with newly defined privileges const roleAuthc = await samlAuth.createM2mApiKeyWithRoleScope('customRole'); // Don't forget to invalidate the API key in the end await samlAuth.invalidateM2mApiKeyWithRoleScope(roleAuthc); ``` (cherry picked from commit f00ac7a) # Conflicts: # packages/kbn-ftr-common-functional-services/services/saml_auth/serverless/auth_provider.ts # packages/kbn-ftr-common-functional-services/services/saml_auth/stateful/auth_provider.ts # x-pack/test_serverless/api_integration/test_suites/common/platform_security/authorization.ts # x-pack/test_serverless/functional/config.base.ts

kibanamachine · 2024-10-15T15:52:19Z

Looks like this PR has a backport PR but it still hasn't been merged. Please merge it ASAP to keep the branches relatively in sync.

…#196351) # Backport This will backport the following commits from `main` to `8.x`: - [[FTR] support custom native roles in serverless tests (#194677)](#194677)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)

…ests (#206129) ## Summary Solves: elastic/security-team#11464 In this PR we are adding the capability to use custom roles for serverless Cypress tests. To do so, we are leveraging the solution proposed in: #194677, meaning that currently we have the same restrictions, therefore, custom roles cannot be used yet in MKI environments. ### Creating a Custom Role To create a custom role, use the Cypress task `createServerlessCustomRole`. This task requires two parameters: - **`roleDescriptor`**: Defines the permissions and access for the role. - **`roleName`**: A unique name for the custom role. Example: ```typescript const roleDescriptor = { elasticsearch: { cluster: ['monitor'], indices: [{ names: ['*'], privileges: ['read'] }], }, kibana: [ { base: ['all'], feature: {}, spaces: ['*'], }, ], }; cy.task('createServerlessCustomRole', { roleDescriptor, roleName: 'customRole' }); ``` ### Using a Custom Role Once the custom role is created, you can log in to the application using your regular `login`` method and passing the name of the role. ```typescript login('customRole'); ``` ### Deleting a Custom Role After your tests, always delete the custom role to ensure a clean environment. Use the `deleteServerlessCustomRole` task and provide the name of the role as the parameter. ```typescript cy.task('deleteServerlessCustomRole', 'customRole'); ``` ### Full workflow Here’s the complete workflow for creating, using, and deleting a custom role: ```typescript const roleDescriptor = { elasticsearch: { cluster: ['monitor'], indices: [{ names: ['*'], privileges: ['read'] }], }, kibana: [ { base: ['all'], feature: {}, spaces: ['*'], }, ], }; before(() => { cy.task('createServerlessCustomRole', { roleDescriptor, roleName: 'customRole' }); }); beforeEach(() => { login('customRole'); }); after(() => { cy.task('deleteServerlessCustomRole', 'customRole'); }); ``` --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

…ests (elastic#206129) ## Summary Solves: elastic/security-team#11464 In this PR we are adding the capability to use custom roles for serverless Cypress tests. To do so, we are leveraging the solution proposed in: elastic#194677, meaning that currently we have the same restrictions, therefore, custom roles cannot be used yet in MKI environments. ### Creating a Custom Role To create a custom role, use the Cypress task `createServerlessCustomRole`. This task requires two parameters: - **`roleDescriptor`**: Defines the permissions and access for the role. - **`roleName`**: A unique name for the custom role. Example: ```typescript const roleDescriptor = { elasticsearch: { cluster: ['monitor'], indices: [{ names: ['*'], privileges: ['read'] }], }, kibana: [ { base: ['all'], feature: {}, spaces: ['*'], }, ], }; cy.task('createServerlessCustomRole', { roleDescriptor, roleName: 'customRole' }); ``` ### Using a Custom Role Once the custom role is created, you can log in to the application using your regular `login`` method and passing the name of the role. ```typescript login('customRole'); ``` ### Deleting a Custom Role After your tests, always delete the custom role to ensure a clean environment. Use the `deleteServerlessCustomRole` task and provide the name of the role as the parameter. ```typescript cy.task('deleteServerlessCustomRole', 'customRole'); ``` ### Full workflow Here’s the complete workflow for creating, using, and deleting a custom role: ```typescript const roleDescriptor = { elasticsearch: { cluster: ['monitor'], indices: [{ names: ['*'], privileges: ['read'] }], }, kibana: [ { base: ['all'], feature: {}, spaces: ['*'], }, ], }; before(() => { cy.task('createServerlessCustomRole', { roleDescriptor, roleName: 'customRole' }); }); beforeEach(() => { login('customRole'); }); after(() => { cy.task('deleteServerlessCustomRole', 'customRole'); }); ``` --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> (cherry picked from commit 255aea7)

…ress tests (#206129) (#206451) # Backport This will backport the following commits from `main` to `8.x`: - [[Security Solution] Supports custom roles in serverless for Cypress tests (#206129)](#206129)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)  Co-authored-by: Gloria Hornero <gloria.hornero@elastic.co>

…ests (elastic#206129) ## Summary Solves: elastic/security-team#11464 In this PR we are adding the capability to use custom roles for serverless Cypress tests. To do so, we are leveraging the solution proposed in: elastic#194677, meaning that currently we have the same restrictions, therefore, custom roles cannot be used yet in MKI environments. ### Creating a Custom Role To create a custom role, use the Cypress task `createServerlessCustomRole`. This task requires two parameters: - **`roleDescriptor`**: Defines the permissions and access for the role. - **`roleName`**: A unique name for the custom role. Example: ```typescript const roleDescriptor = { elasticsearch: { cluster: ['monitor'], indices: [{ names: ['*'], privileges: ['read'] }], }, kibana: [ { base: ['all'], feature: {}, spaces: ['*'], }, ], }; cy.task('createServerlessCustomRole', { roleDescriptor, roleName: 'customRole' }); ``` ### Using a Custom Role Once the custom role is created, you can log in to the application using your regular `login`` method and passing the name of the role. ```typescript login('customRole'); ``` ### Deleting a Custom Role After your tests, always delete the custom role to ensure a clean environment. Use the `deleteServerlessCustomRole` task and provide the name of the role as the parameter. ```typescript cy.task('deleteServerlessCustomRole', 'customRole'); ``` ### Full workflow Here’s the complete workflow for creating, using, and deleting a custom role: ```typescript const roleDescriptor = { elasticsearch: { cluster: ['monitor'], indices: [{ names: ['*'], privileges: ['read'] }], }, kibana: [ { base: ['all'], feature: {}, spaces: ['*'], }, ], }; before(() => { cy.task('createServerlessCustomRole', { roleDescriptor, roleName: 'customRole' }); }); beforeEach(() => { login('customRole'); }); after(() => { cy.task('deleteServerlessCustomRole', 'customRole'); }); ``` --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

dmlemeshko added 3 commits October 2, 2024 11:41

[ftr] login with custom native role

4e79028

Merge remote-tracking branch 'upstream/main' into ftr/support-custom-…

0195b9f

…native-roles

fix typo

7adbe78

dmlemeshko changed the title ~~Ftr/support custom native roles~~ [FTR] support custom native roles in tests Oct 2, 2024

dmlemeshko changed the title ~~[FTR] support custom native roles in tests~~ [FTR] support custom native roles in serverless tests Oct 2, 2024

dmlemeshko added 5 commits October 2, 2024 13:48

fix typo, export interface

150f80d

fix typo

fc86e90

fix API key creation for custom role

30a8002

add comments

8e78de2

Merge branch 'main' into ftr/support-custom-native-roles

53c60c6

dmlemeshko commented Oct 2, 2024

View reviewed changes

dmlemeshko added v9.0.0 FTR v8.16.0 labels Oct 2, 2024

dmlemeshko marked this pull request as ready for review October 2, 2024 14:39

dmlemeshko requested review from a team as code owners October 2, 2024 14:39

dmlemeshko requested a review from jeramysoucy October 2, 2024 14:39

dmlemeshko added release_note:skip Skip the PR/issue when compiling release notes backport:version Backport to applied version labels labels Oct 2, 2024

dmlemeshko added 2 commits October 2, 2024 18:32

Merge branch 'ftr/support-custom-native-roles' of github.com:dmlemesh…

45369f5

…ko/kibana into ftr/support-custom-native-roles

update security/authorization tests

c383b2a

dmlemeshko requested a review from a team as a code owner October 2, 2024 16:53

Merge remote-tracking branch 'upstream/main' into ftr/support-custom-…

a22be26

…native-roles

dmlemeshko mentioned this pull request Oct 4, 2024

[FTR] move role CRUD APIs tests under the default configuration #194933

Closed

dmlemeshko added 3 commits October 4, 2024 13:35

skip tests

f7b9752

Merge branch 'main' into ftr/support-custom-native-roles

2989f2a

Merge branch 'ftr/support-custom-native-roles' of github.com:dmlemesh…

913942e

…ko/kibana into ftr/support-custom-native-roles

dmlemeshko commented Oct 4, 2024

View reviewed changes

Merge branch 'main' into ftr/support-custom-native-roles

403ea84

jeramysoucy approved these changes Oct 11, 2024

View reviewed changes

dmlemeshko added 4 commits October 11, 2024 12:55

move login to before hook

c7cef60

Merge branch 'main' into ftr/support-custom-native-roles

7b57978

Merge branch 'main' into ftr/support-custom-native-roles

898c2f3

Merge branch 'main' into ftr/support-custom-native-roles

c6c4b32

sphilipse approved these changes Oct 11, 2024

View reviewed changes

pheyos approved these changes Oct 11, 2024

View reviewed changes

dmlemeshko enabled auto-merge (squash) October 11, 2024 14:21

dmlemeshko merged commit f00ac7a into elastic:main Oct 11, 2024

This was referenced Oct 12, 2024

[Cloud Security] Graph visualization and API #195307

Merged

[Response Ops][Rules] Add New Rule Form to Stack Management #194655

Merged

dmlemeshko mentioned this pull request Oct 15, 2024

[8.x] [FTR] support custom native roles in serverless tests (#194677) #196351

Merged

kibanamachine added the backport missing Added to PRs automatically when the are determined to be missing a backport. label Oct 15, 2024

kibanamachine removed the backport missing Added to PRs automatically when the are determined to be missing a backport. label Oct 16, 2024

This was referenced Jan 7, 2025

[Security Solution] Support testing with different roles in Serverless Cypress and API integration tests #164451

Open

[Security Solution] Supports custom roles in serverless for Cypress tests #206129

Merged

sorenlouv mentioned this pull request Jan 10, 2025

Observability AI Assistant Tests Deployment Agnostic #205194

Merged

7 tasks

		// skipped, see https://github.com/elastic/kibana/issues/194933
		describe.skip('disabled', () => {

Conversation

dmlemeshko commented Oct 2, 2024 • edited by kibanamachine Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

dmlemeshko Oct 2, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dmlemeshko Oct 4, 2024

Choose a reason for hiding this comment

Uh oh!

jeramysoucy Oct 11, 2024

Choose a reason for hiding this comment

Uh oh!

jeramysoucy left a comment

Choose a reason for hiding this comment

Uh oh!

jeramysoucy Oct 11, 2024

Choose a reason for hiding this comment

Uh oh!

jeramysoucy Oct 11, 2024

Choose a reason for hiding this comment

Uh oh!

jeramysoucy Oct 11, 2024

Choose a reason for hiding this comment

Uh oh!

dmlemeshko Oct 11, 2024

Choose a reason for hiding this comment

Uh oh!

dmlemeshko Oct 11, 2024

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Oct 11, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Public APIs missing comments

Any counts in public APIs

API count

History

Uh oh!

pheyos left a comment

Choose a reason for hiding this comment

Uh oh!

kibanamachine commented Oct 11, 2024

Uh oh!

kibanamachine commented Oct 11, 2024

💔 All backports failed

Manual backport

Questions ?

Uh oh!

dmlemeshko commented Oct 15, 2024

💚 All backports created successfully

Questions ?

Uh oh!

kibanamachine commented Oct 15, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

dmlemeshko commented Oct 2, 2024 •

edited by kibanamachine

Loading

dmlemeshko Oct 2, 2024 •

edited

Loading

elasticmachine commented Oct 11, 2024 •

edited

Loading