[FTR] unify custom role name with Scout by dmlemeshko · Pull Request #217882 · elastic/kibana

dmlemeshko · 2025-04-10T16:09:36Z

Summary

In QAF David added a possibility to spin up MKI project with custom role set and ready to use.

Originally FTR was using reserved name 'customRole' for internal Kibana role to be mapped with native custom role in the project.

Both Scout and FTR use kbn/test to simulate SAML authentication, but the new framework will allow to run the tests in parallel. That said, we need to support multiple custom role credentials (one pair per worker) and for simplicity we decided to use the same keys:

To run your tests locally against MKI you need to add a new Cloud user entry in user_roles.json:

"custom_role_worker_1": { "username": ..., "password": ... }, // FTR requires only the first entry
"custom_role_worker_2": { "username": ..., "password": ... },
...

The test change is minimal:

azasypkin

LGTM from the security/consumer perspective, thanks! 🎖️

azasypkin · 2025-04-11T07:51:55Z

.../packages/shared/kbn-ftr-common-functional-services/services/saml_auth/saml_auth_provider.ts


+    checkRoleIsSupported(role: string): void {
+      if (!supportedRoles.includes(role)) {
+        throw new Error(


question: If a developer sees this error message, how are they supposed to resolve it? If it's resolvable, we can hint at a solution in the error message (the same question for any other error message).

Noted. I will add a text with possible actions.

azasypkin · 2025-04-11T07:57:08Z

.../packages/shared/kbn-ftr-common-functional-services/services/saml_auth/saml_auth_provider.ts


    async createM2mApiKeyWithRoleScope(role: string): Promise<RoleCredentials> {
+      this.checkRoleIsSupported(role);
+      if (role === CUSTOM_ROLE && !isCustomRoleEnabled) {


nit: the name of this flag and error message are a bit confusing. Is it supposed to check that the legacy/deprecated/static/fixed "customRole" custom role is enabled? Right now it feels like it's checking whether any custom role support is enabled or not. But it can just be me, so feel free to ignore.

Also, maybe this check should happen before this.checkRoleIsSupported(role);?

isCustomRoleEnabled is FTR internal flag to restrict custom roles usage in Oblt serverless projects, unless it is explicitly enabled with server argument in config file. I agree, moving check to checkRoleIsSupported makes sense

azasypkin · 2025-04-11T07:59:37Z

.../packages/shared/kbn-ftr-common-functional-services/services/saml_auth/saml_auth_provider.ts

            role === CUSTOM_ROLE
              ? `Before creating API key for '${CUSTOM_ROLE}', use 'samlAuth.setCustomRole' to set the role privileges`
-              : `Cannot create API key for non-existent role "${role}"`
+              : `Cannot create API key for role "${role}", role descriptor not found`


question: not found, not found where? (re: my question about making error messages more actionable and helpful) 🙂

azasypkin · 2025-04-11T08:01:22Z

src/platform/packages/shared/kbn-scout/src/playwright/fixtures/worker/core_fixtures.ts

    ({ log, config, esClient, kbnClient }, use, workerInfo) => {
-      let customRoleHash = '';
-      const customRoleName = `custom_role_worker_${workerInfo.parallelIndex}`;
+      /**


Thanks for adding a comment 🎖️

x-pack/test_serverless/README.md

.../packages/shared/kbn-ftr-common-functional-services/services/saml_auth/saml_auth_provider.ts

…hko/kibana into unify-ftr-custom-role-with-scout

…s/services/saml_auth/saml_auth_provider.ts Co-authored-by: Cesare de Cal <cesare.decal@elastic.co>

…hko/kibana into unify-ftr-custom-role-with-scout

.../packages/shared/kbn-ftr-common-functional-services/services/saml_auth/saml_auth_provider.ts

…hko/kibana into unify-ftr-custom-role-with-scout

csr

LGTM. Dima and I confirmed that FTR handles both of these cases correctly:

✅ The custom role already exists in the Kibana project → FTR updates the role descriptors.
✅ The custom role doesn't exist in the Kibana project → FTR creates the role and sets its role descriptors.

In both cases:

The custom role is deleted in the after block of the test suite. (Note: Scout behaves slightly differently—it doesn't delete the role at the end of the test and only updates the descriptors if they’ve changed. This may change in the future.)
We observed that the Elastic Cloud user keeps the custom role assignment (as expected), even after the role itself is deleted from the project. The role assignment persists across test runs.

ElenaStoeva

Data streams test changes lgtm.

elasticmachine · 2025-04-14T08:06:43Z

💔 Build Failed

Buildkite Build
Commit: 3cdfaa6

Failed CI Steps

Build Kibana Distribution

History

💚 Build #292364 succeeded b413a3f
💛 Build #292244 was flaky ff99e97
💛 Build #292099 was flaky 3a2e650
💔 Build #292087 failed 32a23ca
💔 Build #292074 failed 2cec2bf

szwarckonrad

SecSol change LGTM.
CC @janmonschke since you authored the modified lines

kibanamachine · 2025-04-14T17:22:06Z

Starting backport for target branches: 8.x, 9.0

https://github.com/elastic/kibana/actions/runs/14451761445

## Summary In QAF David added a possibility to spin up MKI project with custom role set and ready to use. Originally FTR was using reserved name `'customRole'` for internal Kibana role to be mapped with native custom role in the project. Both Scout and FTR use `kbn/test` to simulate SAML authentication, but the new framework will allow to run the tests in parallel. That said, we need to support multiple custom role credentials (one pair per worker) and for simplicity we decided to use the same keys: To run your tests locally against MKI you need to add a new Cloud user entry in `user_roles.json`: ``` "custom_role_worker_1": { "username": ..., "password": ... }, // FTR requires only the first entry "custom_role_worker_2": { "username": ..., "password": ... }, ... ``` The test change is minimal: <img width="559" alt="image" src="https://github.com/user-attachments/assets/572103a3-13b2-4e6c-b9d2-5e55b03ac51c" /> --------- Co-authored-by: Cesare de Cal <cesare.decal@elastic.co> (cherry picked from commit c4a97e5)

kibanamachine · 2025-04-14T17:28:58Z

💔 Some backports could not be created

Status	Branch	Result
❌	8.x	Backport failed because of merge conflicts You might need to backport the following PRs to 8.x: - [Charts] Use chartTheme hook everywhere (#217370) - [jest] @emotion/babel-preset-css-prop (#216489) - [ES\|QL] Adds license knowledge to the editor (#217796) - [Expression] Cached expression can keep their own side effects (#216519)
✅	9.0

Note: Successful backport PRs will be merged automatically after passing CI.

Manual backport

To create the backport manually run:

node scripts/backport --pr 217882

Questions ?

Please refer to the Backport tool documentation

# Backport This will backport the following commits from `main` to `9.0`: - [[FTR] unify custom role name with Scout (#217882)](#217882)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: Dzmitry Lemechko <dzmitry.lemechko@elastic.co>

## Summary In QAF David added a possibility to spin up MKI project with custom role set and ready to use. Originally FTR was using reserved name `'customRole'` for internal Kibana role to be mapped with native custom role in the project. Both Scout and FTR use `kbn/test` to simulate SAML authentication, but the new framework will allow to run the tests in parallel. That said, we need to support multiple custom role credentials (one pair per worker) and for simplicity we decided to use the same keys: To run your tests locally against MKI you need to add a new Cloud user entry in `user_roles.json`: ``` "custom_role_worker_1": { "username": ..., "password": ... }, // FTR requires only the first entry "custom_role_worker_2": { "username": ..., "password": ... }, ... ``` The test change is minimal: <img width="559" alt="image" src="https://github.com/user-attachments/assets/572103a3-13b2-4e6c-b9d2-5e55b03ac51c" /> --------- Co-authored-by: Cesare de Cal <cesare.decal@elastic.co> (cherry picked from commit c4a97e5) # Conflicts: # x-pack/test/spaces_api_integration/deployment_agnostic/services/role_scoped_supertest.ts

dmlemeshko · 2025-04-15T12:29:42Z

💚 All backports created successfully

Status	Branch	Result
✅	8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

# Backport This will backport the following commits from `main` to `8.x`: - [[FTR] unify custom role name with Scout (#217882)](#217882)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)

[use the same naming for custom native roles in scout/ftr]

c3d6e69

dmlemeshko requested a review from pheyos April 10, 2025 16:12

improve role name validation, fix call

2cec2bf

dmlemeshko mentioned this pull request Apr 10, 2025

chore(streams): returns 403 when user has no read access #217742

Merged

dmlemeshko added 2 commits April 10, 2025 19:21

validate role before browser auth

5866bc9

fix

32a23ca

dmlemeshko added FTR v9.1.0 v9.0.1 release_note:skip Skip the PR/issue when compiling release notes v8.19.0 backport:version Backport to applied version labels labels Apr 10, 2025

dmlemeshko marked this pull request as ready for review April 10, 2025 17:31

dmlemeshko requested review from a team as code owners April 10, 2025 17:31

jbudz approved these changes Apr 10, 2025

View reviewed changes

dmlemeshko added 2 commits April 10, 2025 20:31

Update security_solution_serverless_utils.ts

979cca5

Merge branch 'main' into unify-ftr-custom-role-with-scout

3a2e650

azasypkin approved these changes Apr 11, 2025

View reviewed changes

csr reviewed Apr 11, 2025

View reviewed changes

x-pack/test_serverless/README.md Outdated Show resolved Hide resolved

csr reviewed Apr 11, 2025

View reviewed changes

.../packages/shared/kbn-ftr-common-functional-services/services/saml_auth/saml_auth_provider.ts Outdated Show resolved Hide resolved

dmlemeshko added 2 commits April 11, 2025 11:37

update error messages

b6b11e2

Merge branch 'unify-ftr-custom-role-with-scout' of github.com:dmlemes…

b7bac7e

…hko/kibana into unify-ftr-custom-role-with-scout

dmlemeshko requested a review from a team as a code owner April 11, 2025 09:44

dmlemeshko and others added 2 commits April 11, 2025 11:45

fix docs

16a2516

Update src/platform/packages/shared/kbn-ftr-common-functional-service…

ff99e97

…s/services/saml_auth/saml_auth_provider.ts Co-authored-by: Cesare de Cal <cesare.decal@elastic.co>

dmlemeshko added 2 commits April 11, 2025 17:15

update error handling for role update

e369de4

Merge branch 'unify-ftr-custom-role-with-scout' of github.com:dmlemes…

64ad1ad

…hko/kibana into unify-ftr-custom-role-with-scout

dmlemeshko commented Apr 11, 2025

View reviewed changes

.../packages/shared/kbn-ftr-common-functional-services/services/saml_auth/saml_auth_provider.ts Show resolved Hide resolved

dmlemeshko added 3 commits April 11, 2025 17:17

Merge branch 'main' into unify-ftr-custom-role-with-scout

8773b38

update message

56386f0

Merge branch 'unify-ftr-custom-role-with-scout' of github.com:dmlemes…

b413a3f

…hko/kibana into unify-ftr-custom-role-with-scout

dmlemeshko requested a review from csr April 11, 2025 15:26

TattdCodeMonkey approved these changes Apr 11, 2025

View reviewed changes

csr approved these changes Apr 11, 2025

View reviewed changes

ElenaStoeva approved these changes Apr 11, 2025

View reviewed changes

Merge branch 'main' into unify-ftr-custom-role-with-scout

3cdfaa6

szwarckonrad approved these changes Apr 14, 2025

View reviewed changes

Merge branch 'main' into unify-ftr-custom-role-with-scout

8a2356a

dmlemeshko merged commit c4a97e5 into elastic:main Apr 14, 2025
10 checks passed

kibanamachine mentioned this pull request Apr 14, 2025

[9.0] [FTR] unify custom role name with Scout (#217882) #218152

Merged

kibanamachine added the v9.0.0 label Apr 14, 2025

dmlemeshko mentioned this pull request Apr 15, 2025

[8.x] [FTR] unify custom role name with Scout (#217882) #218260

Merged

dmlemeshko self-assigned this Apr 15, 2025

mistic removed the v9.0.0 label Apr 15, 2025

Comments

Conversation

dmlemeshko commented Apr 10, 2025 • edited by kibanamachine Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

azasypkin left a comment

Choose a reason for hiding this comment

Uh oh!

azasypkin Apr 11, 2025

Choose a reason for hiding this comment

Uh oh!

dmlemeshko Apr 11, 2025

Choose a reason for hiding this comment

Uh oh!

azasypkin Apr 11, 2025

Choose a reason for hiding this comment

Uh oh!

dmlemeshko Apr 11, 2025

Choose a reason for hiding this comment

Uh oh!

azasypkin Apr 11, 2025

Choose a reason for hiding this comment

Uh oh!

azasypkin Apr 11, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

csr left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ElenaStoeva left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Apr 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💔 Build Failed

Failed CI Steps

History

Uh oh!

szwarckonrad left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kibanamachine commented Apr 14, 2025

Uh oh!

kibanamachine commented Apr 14, 2025

💔 Some backports could not be created

Manual backport

Questions ?

Uh oh!

dmlemeshko commented Apr 15, 2025

💚 All backports created successfully

Questions ?

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

dmlemeshko commented Apr 10, 2025 •

edited by kibanamachine

Loading

csr left a comment •

edited

Loading

elasticmachine commented Apr 14, 2025 •

edited

Loading