[Backport 2.x] Cypress13 testing frame work for OIDC and SAML

[RyanL1997]

Description

Manual Backport from #1579

Category

Enhancement

Check List

• New functionality includes testing
• New functionality has been documented
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (61d9530) 66.73% compared to head (3801960) 66.73%.

❗ Current head 3801960 differs from pull request most recent head 38e6d4b. Consider uploading reports for the commit 38e6d4b to get more accurate results

Additional details and impacted files

@@           Coverage Diff           @@
##              2.x    #1691   +/-   ##
=======================================
  Coverage   66.73%   66.73%           
=======================================
  Files          93       93           
  Lines        2351     2351           
  Branches      311      316    +5     
=======================================
  Hits         1569     1569           
  Misses        705      705           
  Partials       77       77           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[cwperks]

@RyanL1997 I will help looking at the saml_multiauth test failures. One thing I noticed is that on a fresh cluster I get this issue, but if I manually update the security config they pass.

Command to update security config

curl -XPUT https://admin:admin@localhost:9200/_plugins/_security/api/securityconfig/config -k -H "Content-Type: application/json" --data ' { "dynamic": { "filtered_alias_mode": "warn", "disable_rest_auth": false, "disable_intertransport_auth": false, "respect_request_indices_options": false, "kibana": { "multitenancy_enabled": true, "server_username": "kibanaserver", "index": ".kibana" }, "http": { "anonymous_auth_enabled": false, "xff": { "enabled": false, "internalProxies": "192\\.168\\.0\\.10|192\\.168\\.0\\.11", "remoteIpHeader": "X-Forwarded-For" } }, "authc": { "jwt_auth_domain": { "http_enabled": false, "transport_enabled": false, "order": 0, "http_authenticator": { "challenge": false, "type": "jwt", "config": { "signing_key": "base64 encoded HMAC key or public RSA/ECDSA pem key", "jwt_header": "Authorization", "jwt_clock_skew_tolerance_seconds": 30 } }, "authentication_backend": { "type": "noop", "config": {} }, "description": "Authenticate via Json Web Token" }, "ldap": { "http_enabled": false, "transport_enabled": false, "order": 5, "http_authenticator": { "challenge": false, "type": "basic", "config": {} }, "authentication_backend": { "type": "ldap", "config": { "enable_ssl": false, "enable_start_tls": false, "enable_ssl_client_auth": false, "verify_hostnames": true, "hosts": [ "localhost:8389" ], "userbase": "ou=people,dc=example,dc=com", "usersearch": "(sAMAccountName={0})" } }, "description": "Authenticate via LDAP or Active Directory" }, "basic_internal_auth_domain": { "http_enabled": true, "transport_enabled": true, "order": 4, "http_authenticator": { "challenge": false, "type": "basic", "config": {} }, "authentication_backend": { "type": "intern", "config": {} }, "description": "Authenticate via HTTP Basic against internal users database" }, "proxy_auth_domain": { "http_enabled": false, "transport_enabled": false, "order": 3, "http_authenticator": { "challenge": false, "type": "proxy", "config": { "user_header": "x-proxy-user", "roles_header": "x-proxy-roles" } }, "authentication_backend": { "type": "noop", "config": {} }, "description": "Authenticate via proxy" }, "clientcert_auth_domain": { "http_enabled": false, "transport_enabled": false, "order": 2, "http_authenticator": { "challenge": false, "type": "clientcert", "config": { "username_attribute": "cn" } }, "authentication_backend": { "type": "noop", "config": {} }, "description": "Authenticate via SSL client certificates" }, "saml_auth_domain": { "http_enabled": true, "transport_enabled": false, "order": 5, "http_authenticator": { "challenge": true, "type": "saml", "config": { "idp": { "metadata_url": "http://localhost:7000/metadata", "entity_id": "urn:example:idp" }, "sp": { "entity_id": "https://localhost:9200" }, "kibana_url": "http://localhost:5601", "exchange_key": "6aff3042-1327-4f3d-82f0-40a157ac4464" } }, "authentication_backend": { "type": "noop", "config": {} } }, "kerberos_auth_domain": { "http_enabled": false, "transport_enabled": false, "order": 6, "http_authenticator": { "challenge": true, "type": "kerberos", "config": { "krb_debug": false, "strip_realm_from_principal": true } }, "authentication_backend": { "type": "noop", "config": {} } } }, "authz": { "roles_from_another_ldap": { "http_enabled": false, "transport_enabled": false, "authorization_backend": { "type": "ldap", "config": {} }, "description": "Authorize via another Active Directory" }, "roles_from_myldap": { "http_enabled": false, "transport_enabled": false, "authorization_backend": { "type": "ldap", "config": { "enable_ssl": false, "enable_start_tls": false, "enable_ssl_client_auth": false, "verify_hostnames": true, "hosts": [ "localhost:8389" ], "rolebase": "ou=groups,dc=example,dc=com", "rolesearch": "(member={0})", "userrolename": "disabled", "rolename": "cn", "resolve_nested_roles": true, "userbase": "ou=people,dc=example,dc=com", "usersearch": "(uid={0})" } }, "description": "Authorize via LDAP or Active Directory" } }, "auth_failure_listeners": {}, "do_not_fail_on_forbidden": false, "multi_rolespan_enabled": true, "hosts_resolver_mode": "ip-only", "do_not_fail_on_forbidden_empty": false } }'

Edit: They may also be related to opensearch-project/security#3671

[cwperks]

@RyanL1997 This PR will fix the failing SAML checks: opensearch-project/security#3853