Skip to content

Commit fb29691

Browse files
azasypkinazasypkin
authored
[7.x] Do not embedd credentials into ES URL and enable anonymous tests. (#88005)
1 parent 569a7b2 commit fb29691

10 files changed

Lines changed: 34 additions & 27 deletions

File tree

‎test/common/config.js‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,14 @@ export default function () {
4444
'--logging.json=false',
4545
`--server.port=${kbnTestConfig.getPort()}`,
4646
'--status.allowAnonymous=true',
47-
`--elasticsearch.hosts=${formatUrl(servers.elasticsearch)}`,
47+
// We shouldn't embed credentials into the URL since Kibana requests to Elasticsearch should
48+
// either include `kibanaServerTestUser` credentials, or credentials provided by the test
49+
// user, or none at all in case anonymous access is used.
50+
`--elasticsearch.hosts=${formatUrl(
51+
Object.fromEntries(
52+
Object.entries(servers.elasticsearch).filter(([key]) => key.toLowerCase() !== 'auth')
53+
)
54+
)}`,
4855
`--elasticsearch.username=${kibanaServerTestUser.username}`,
4956
`--elasticsearch.password=${kibanaServerTestUser.password}`,
5057
`--home.disableWelcomeScreen=true`,

‎x-pack/scripts/functional_tests.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ require('@kbn/test').runTestsCli([
4545
require.resolve('../test/security_api_integration/oidc_implicit_flow.config.ts'),
4646
require.resolve('../test/security_api_integration/token.config.ts'),
4747
require.resolve('../test/security_api_integration/anonymous.config.ts'),
48+
require.resolve('../test/security_api_integration/anonymous_es_anonymous.config.ts'),
4849
require.resolve('../test/observability_api_integration/basic/config.ts'),
4950
require.resolve('../test/observability_api_integration/trial/config.ts'),
5051
require.resolve('../test/encrypted_saved_objects_api_integration/config'),

‎x-pack/test/functional/page_objects/security_page.ts‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
* you may not use this file except in compliance with the Elastic License.
55
*/
66

7+
import { adminTestUser } from '@kbn/test';
78
import { FtrProviderContext } from '../ftr_provider_context';
89
import { AuthenticatedUser, Role } from '../../../plugins/security/common/model';
910

@@ -122,9 +123,8 @@ export function SecurityPageProvider({ getService, getPageObjects }: FtrProvider
122123
await browser.setLocalStorageItem('home:welcome:show', 'false');
123124
await waitForLoginForm();
124125

125-
const [superUsername, superPassword] = config.get('servers.elasticsearch.auth').split(':');
126-
await testSubjects.setValue('loginUsername', username || superUsername);
127-
await testSubjects.setValue('loginPassword', password || superPassword);
126+
await testSubjects.setValue('loginUsername', username || adminTestUser.username);
127+
await testSubjects.setValue('loginPassword', password || adminTestUser.password);
128128
await testSubjects.click('loginSubmit');
129129

130130
await waitForLoginResult(
@@ -162,9 +162,8 @@ export function SecurityPageProvider({ getService, getPageObjects }: FtrProvider
162162
if (providerType === 'basic' || providerType === 'token') {
163163
await waitForLoginForm();
164164

165-
const [superUsername, superPassword] = config.get('servers.elasticsearch.auth').split(':');
166-
await testSubjects.setValue('loginUsername', options?.username ?? superUsername);
167-
await testSubjects.setValue('loginPassword', options?.password ?? superPassword);
165+
await testSubjects.setValue('loginUsername', options?.username ?? adminTestUser.username);
166+
await testSubjects.setValue('loginPassword', options?.password ?? adminTestUser.password);
168167
await testSubjects.click('loginSubmit');
169168
}
170169

‎x-pack/test/security_api_integration/tests/anonymous/login.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66

77
import expect from '@kbn/expect';
88
import request, { Cookie } from 'request';
9+
import { adminTestUser } from '@kbn/test';
910
import { FtrProviderContext } from '../../ftr_provider_context';
1011

1112
export default function ({ getService }: FtrProviderContext) {
@@ -55,15 +56,14 @@ export default function ({ getService }: FtrProviderContext) {
5556
});
5657

5758
it('does not prevent basic login', async () => {
58-
const [username, password] = config.get('servers.elasticsearch.auth').split(':');
5959
const response = await supertest
6060
.post('/internal/security/login')
6161
.set('kbn-xsrf', 'xxx')
6262
.send({
6363
providerType: 'basic',
6464
providerName: 'basic1',
6565
currentURL: '/',
66-
params: { username, password },
66+
params: { username: adminTestUser.username, password: adminTestUser.password },
6767
})
6868
.expect(200);
6969

@@ -79,7 +79,7 @@ export default function ({ getService }: FtrProviderContext) {
7979
.set('Cookie', cookie.cookieString())
8080
.expect(200);
8181

82-
expect(user.username).to.eql(username);
82+
expect(user.username).to.eql(adminTestUser.username);
8383
expect(user.authentication_provider).to.eql({ type: 'basic', name: 'basic1' });
8484
expect(user.authentication_type).to.eql('realm');
8585
// Do not assert on the `authentication_realm`, as the value differs for on-prem vs cloud

‎x-pack/test/security_api_integration/tests/kerberos/kerberos_login.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
import expect from '@kbn/expect';
88
import request, { Cookie } from 'request';
99
import { delay } from 'bluebird';
10+
import { adminTestUser } from '@kbn/test';
1011
import { FtrProviderContext } from '../../ftr_provider_context';
1112
import {
1213
getMutualAuthenticationResponseToken,
@@ -54,15 +55,14 @@ export default function ({ getService }: FtrProviderContext) {
5455
});
5556

5657
it('does not prevent basic login', async () => {
57-
const [username, password] = config.get('servers.elasticsearch.auth').split(':');
5858
const response = await supertest
5959
.post('/internal/security/login')
6060
.set('kbn-xsrf', 'xxx')
6161
.send({
6262
providerType: 'basic',
6363
providerName: 'basic',
6464
currentURL: '/',
65-
params: { username, password },
65+
params: { username: adminTestUser.username, password: adminTestUser.password },
6666
})
6767
.expect(200);
6868

@@ -78,7 +78,7 @@ export default function ({ getService }: FtrProviderContext) {
7878
.set('Cookie', cookie.cookieString())
7979
.expect(200);
8080

81-
expect(user.username).to.eql(username);
81+
expect(user.username).to.eql(adminTestUser.username);
8282
expect(user.authentication_provider).to.eql({ type: 'basic', name: 'basic' });
8383
expect(user.authentication_type).to.eql('realm');
8484
// Do not assert on the `authentication_realm`, as the value differs for on-prem vs cloud

‎x-pack/test/security_api_integration/tests/oidc/authorization_code_flow/oidc_auth.ts‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,28 +8,27 @@ import expect from '@kbn/expect';
88
import request, { Cookie } from 'request';
99
import url from 'url';
1010
import { delay } from 'bluebird';
11+
import { adminTestUser } from '@kbn/test';
1112
import { getStateAndNonce } from '../../../fixtures/oidc/oidc_tools';
1213
import { FtrProviderContext } from '../../../ftr_provider_context';
1314

1415
export default function ({ getService }: FtrProviderContext) {
1516
const supertest = getService('supertestWithoutAuth');
16-
const config = getService('config');
1717

1818
describe('OpenID Connect authentication', () => {
1919
it('should reject API requests if client is not authenticated', async () => {
2020
await supertest.get('/internal/security/me').set('kbn-xsrf', 'xxx').expect(401);
2121
});
2222

2323
it('does not prevent basic login', async () => {
24-
const [username, password] = config.get('servers.elasticsearch.auth').split(':');
2524
const response = await supertest
2625
.post('/internal/security/login')
2726
.set('kbn-xsrf', 'xxx')
2827
.send({
2928
providerType: 'basic',
3029
providerName: 'basic',
3130
currentURL: '/',
32-
params: { username, password },
31+
params: { username: adminTestUser.username, password: adminTestUser.password },
3332
})
3433
.expect(200);
3534

@@ -42,10 +41,10 @@ export default function ({ getService }: FtrProviderContext) {
4241
.set('Cookie', request.cookie(cookies[0])!.cookieString())
4342
.expect(200);
4443

45-
expect(user.username).to.eql(username);
44+
expect(user.username).to.eql(adminTestUser.username);
4645
expect(user.authentication_provider).to.eql({ type: 'basic', name: 'basic' });
4746
expect(user.authentication_type).to.be('realm');
48-
// Do not assert on the `authentication_realm`, as the value differes for on-prem vs cloud
47+
// Do not assert on the `authentication_realm`, as the value differs for on-prem vs cloud
4948
});
5049

5150
describe('initiating handshake', () => {

‎x-pack/test/security_api_integration/tests/pki/pki_auth.ts‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import { delay } from 'bluebird';
1010
import { readFileSync } from 'fs';
1111
import { resolve } from 'path';
1212
import { CA_CERT_PATH } from '@kbn/dev-utils';
13+
import { adminTestUser } from '@kbn/test';
1314
import { FtrProviderContext } from '../../ftr_provider_context';
1415

1516
const CA_CERT = readFileSync(CA_CERT_PATH);
@@ -21,7 +22,6 @@ const UNTRUSTED_CLIENT_CERT = readFileSync(
2122

2223
export default function ({ getService }: FtrProviderContext) {
2324
const supertest = getService('supertestWithoutAuth');
24-
const config = getService('config');
2525

2626
function checkCookieIsSet(cookie: Cookie) {
2727
expect(cookie.value).to.not.be.empty();
@@ -64,7 +64,6 @@ export default function ({ getService }: FtrProviderContext) {
6464
});
6565

6666
it('does not prevent basic login', async () => {
67-
const [username, password] = config.get('servers.elasticsearch.auth').split(':');
6867
const response = await supertest
6968
.post('/internal/security/login')
7069
.ca(CA_CERT)
@@ -74,7 +73,7 @@ export default function ({ getService }: FtrProviderContext) {
7473
providerType: 'basic',
7574
providerName: 'basic',
7675
currentURL: '/',
77-
params: { username, password },
76+
params: { username: adminTestUser.username, password: adminTestUser.password },
7877
})
7978
.expect(200);
8079

@@ -92,7 +91,7 @@ export default function ({ getService }: FtrProviderContext) {
9291
.set('Cookie', cookie.cookieString())
9392
.expect(200);
9493

95-
expect(user.username).to.eql(username);
94+
expect(user.username).to.eql(adminTestUser.username);
9695
expect(user.authentication_provider).to.eql({ type: 'basic', name: 'basic' });
9796
// Do not assert on the `authentication_realm`, as the value differs for on-prem vs cloud
9897
});

‎x-pack/test/security_api_integration/tests/saml/saml_login.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import url from 'url';
99
import { delay } from 'bluebird';
1010
import expect from '@kbn/expect';
1111
import request, { Cookie } from 'request';
12+
import { adminTestUser } from '@kbn/test';
1213
import {
1314
getLogoutRequest,
1415
getSAMLRequestId,
@@ -75,15 +76,14 @@ export default function ({ getService }: FtrProviderContext) {
7576
});
7677

7778
it('does not prevent basic login', async () => {
78-
const [username, password] = config.get('servers.elasticsearch.auth').split(':');
7979
const response = await supertest
8080
.post('/internal/security/login')
8181
.set('kbn-xsrf', 'xxx')
8282
.send({
8383
providerType: 'basic',
8484
providerName: 'basic',
8585
currentURL: '/',
86-
params: { username, password },
86+
params: { username: adminTestUser.username, password: adminTestUser.password },
8787
})
8888
.expect(200);
8989

@@ -96,7 +96,7 @@ export default function ({ getService }: FtrProviderContext) {
9696
.set('Cookie', request.cookie(cookies[0])!.cookieString())
9797
.expect(200);
9898

99-
expect(user.username).to.eql(username);
99+
expect(user.username).to.eql(adminTestUser.username);
100100
expect(user.authentication_provider).to.eql({ type: 'basic', name: 'basic' });
101101
expect(user.authentication_type).to.be('realm');
102102
// Do not assert on the `authentication_realm`, as the value differes for on-prem vs cloud

‎x-pack/test/security_api_integration/tests/session_idle/cleanup.ts‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
import request, { Cookie } from 'request';
88
import { delay } from 'bluebird';
99
import expect from '@kbn/expect';
10+
import { adminTestUser } from '@kbn/test';
1011
import type { AuthenticationProvider } from '../../../../plugins/security/common/model';
1112
import { getSAMLRequestId, getSAMLResponse } from '../../fixtures/saml/saml_tools';
1213
import { FtrProviderContext } from '../../ftr_provider_context';
@@ -17,7 +18,7 @@ export default function ({ getService }: FtrProviderContext) {
1718
const config = getService('config');
1819
const log = getService('log');
1920
const randomness = getService('randomness');
20-
const [basicUsername, basicPassword] = config.get('servers.elasticsearch.auth').split(':');
21+
const { username: basicUsername, password: basicPassword } = adminTestUser;
2122
const kibanaServerConfig = config.get('servers.kibana');
2223

2324
async function checkSessionCookie(

‎x-pack/test/security_api_integration/tests/session_lifespan/cleanup.ts‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
import request, { Cookie } from 'request';
88
import { delay } from 'bluebird';
99
import expect from '@kbn/expect';
10+
import { adminTestUser } from '@kbn/test';
1011
import type { AuthenticationProvider } from '../../../../plugins/security/common/model';
1112
import { getSAMLRequestId, getSAMLResponse } from '../../fixtures/saml/saml_tools';
1213
import { FtrProviderContext } from '../../ftr_provider_context';
@@ -16,7 +17,7 @@ export default function ({ getService }: FtrProviderContext) {
1617
const es = getService('es');
1718
const config = getService('config');
1819
const randomness = getService('randomness');
19-
const [basicUsername, basicPassword] = config.get('servers.elasticsearch.auth').split(':');
20+
const { username: basicUsername, password: basicPassword } = adminTestUser;
2021
const kibanaServerConfig = config.get('servers.kibana');
2122

2223
async function checkSessionCookie(

0 commit comments

Comments
 (0)