honeymoose
/
OpenSearch
mirror of https://github.com/honeymoose/OpenSearch.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
OpenSearch/x-pack/qa/saml-idp-tests/build.gradle

94 lines
4.5 KiB
Groovy
Raw Normal View History

Build: Replace references to x-pack-elasticsearch paths with helper methods (elastic/x-pack-elasticsearch#3748) In order to more easily integrate xpack once it moves into the elasticsearch repo, references to the existing x-pack-elasticsearch need to be reduced. This commit introduces a few helper "methods" available to any project within xpack (through gradle project extension properties, as closures). All refeerences to project paths now use these helper methods, except for those pertaining to bwc, which will be handled in a followup. Original commit: elastic/x-pack-elasticsearch@850668744c7188f3ca8d6ff561c99fbd8995288e
2018-01-27 00:48:30 -05:00
Project idpFixtureProject = xpackProject("test:idp-fixture")
evaluationDependsOn(idpFixtureProject.path)
Switch SAML QA test to use a standalone cluster (elastic/x-pack-elasticsearch#3743) Introduce a healthy dose of reality into the SAML integration tests. Switches the test class from *Tests to *IT, and updates the build to run it during integTest Original commit: elastic/x-pack-elasticsearch@edd2538e5fb8486c557a657ec5d503c3d1c73ab0
2018-01-30 07:03:04 -05:00
apply plugin: 'elasticsearch.standalone-rest-test'
apply plugin: 'elasticsearch.rest-test'
Replace Vagrant with Docker for idp-fixture (#39948) The change replaces the Vagrant box based fixture with a fixture based on docker compose and 2 docker images, one for an openldap server and one for a Shibboleth SAML Identity Provider. The configuration of both openldap and shibboleth is identical to the previous one, in order to minimize required changes in the tests
2019-03-12 17:54:23 -04:00
apply plugin: 'elasticsearch.test.fixtures'
[Security] Add SAML authentication support (elastic/x-pack-elasticsearch#3646) Introduces: - SAML Realm - REST & Transport actions to support SAML single signon / signout - Tests for above - More XML than you ever wanted to see. Original commit: elastic/x-pack-elasticsearch@b0fe7bb6528e02de11dce392e498efb8dde150a4
2018-01-20 17:43:00 -05:00
dependencies {
Build: Rework shadow plugin configuration (#32409) This reworks how we configure the `shadow` plugin in the build. The major change is that we no longer bundle dependencies in the `compile` configuration, instead we bundle dependencies in the new `bundle` configuration. This feels more right because it is a little more "opt in" rather than "opt out" and the name of the `bundle` configuration is a little more obvious. As an neat side effect of this, the `runtimeElements` configuration used when one project depends on another now contains exactly the dependencies needed to run the project so you no longer need to reference projects that use the shadow plugin like this: ``` testCompile project(path: ':client:rest-high-level', configuration: 'shadow') ``` You can instead use the much more normal: ``` testCompile "org.elasticsearch.client:elasticsearch-rest-high-level-client:${version}" ```
2018-08-21 20:03:28 -04:00
// "org.elasticsearch.plugin:x-pack-core:${version}" doesn't work with idea because the testArtifacts are also here
testCompile project(path: xpackModule('core'), configuration: 'default')
Build: Replace references to x-pack-elasticsearch paths with helper methods (elastic/x-pack-elasticsearch#3748) In order to more easily integrate xpack once it moves into the elasticsearch repo, references to the existing x-pack-elasticsearch need to be reduced. This commit introduces a few helper "methods" available to any project within xpack (through gradle project extension properties, as closures). All refeerences to project paths now use these helper methods, except for those pertaining to bwc, which will be handled in a followup. Original commit: elastic/x-pack-elasticsearch@850668744c7188f3ca8d6ff561c99fbd8995288e
2018-01-27 00:48:30 -05:00
testCompile project(path: xpackModule('core'), configuration: 'testArtifacts')
testCompile project(path: xpackModule('security'), configuration: 'testArtifacts')
[Security] Add SAML authentication support (elastic/x-pack-elasticsearch#3646) Introduces: - SAML Realm - REST & Transport actions to support SAML single signon / signout - Tests for above - More XML than you ever wanted to see. Original commit: elastic/x-pack-elasticsearch@b0fe7bb6528e02de11dce392e498efb8dde150a4
2018-01-20 17:43:00 -05:00
testCompile 'com.google.jimfs:jimfs:1.1'
}
Replace Vagrant with Docker for idp-fixture (#39948) The change replaces the Vagrant box based fixture with a fixture based on docker compose and 2 docker images, one for an openldap server and one for a Shibboleth SAML Identity Provider. The configuration of both openldap and shibboleth is identical to the previous one, in order to minimize required changes in the tests
2019-03-12 17:54:23 -04:00
testFixtures.useFixture ":x-pack:test:idp-fixture"
[Security] Add SAML authentication support (elastic/x-pack-elasticsearch#3646) Introduces: - SAML Realm - REST & Transport actions to support SAML single signon / signout - Tests for above - More XML than you ever wanted to see. Original commit: elastic/x-pack-elasticsearch@b0fe7bb6528e02de11dce392e498efb8dde150a4
2018-01-20 17:43:00 -05:00
Build: move generated-resources to build (#30366) This commit moves the generated-resources directory to be within the build directory for the openldap-tests and saml-idp-tests projects. Both projects create a generated-resources directory that should have been in the build directory but were instead at the same level as the build directory.
2018-05-10 09:35:23 -04:00
String outputDir = "${project.buildDir}/generated-resources/${project.name}"
Switch SAML QA test to use a standalone cluster (elastic/x-pack-elasticsearch#3743) Introduce a healthy dose of reality into the SAML integration tests. Switches the test class from *Tests to *IT, and updates the build to run it during integTest Original commit: elastic/x-pack-elasticsearch@edd2538e5fb8486c557a657ec5d503c3d1c73ab0
2018-01-30 07:03:04 -05:00
task copyIdpCertificate(type: Copy) {
Replace Vagrant with Docker for idp-fixture (#39948) The change replaces the Vagrant box based fixture with a fixture based on docker compose and 2 docker images, one for an openldap server and one for a Shibboleth SAML Identity Provider. The configuration of both openldap and shibboleth is identical to the previous one, in order to minimize required changes in the tests
2019-03-12 17:54:23 -04:00
from idpFixtureProject.file('idp/shibboleth-idp/credentials/idp-browser.pem');
Switch SAML QA test to use a standalone cluster (elastic/x-pack-elasticsearch#3743) Introduce a healthy dose of reality into the SAML integration tests. Switches the test class from *Tests to *IT, and updates the build to run it during integTest Original commit: elastic/x-pack-elasticsearch@edd2538e5fb8486c557a657ec5d503c3d1c73ab0
2018-01-30 07:03:04 -05:00
into outputDir
}
Replace Vagrant with Docker for idp-fixture (#39948) The change replaces the Vagrant box based fixture with a fixture based on docker compose and 2 docker images, one for an openldap server and one for a Shibboleth SAML Identity Provider. The configuration of both openldap and shibboleth is identical to the previous one, in order to minimize required changes in the tests
2019-03-12 17:54:23 -04:00
project.sourceSets.test.output.dir(outputDir, builtBy: copyIdpCertificate)
integTestCluster.dependsOn copyIdpCertificate
[Security] Add SAML authentication support (elastic/x-pack-elasticsearch#3646) Introduces: - SAML Realm - REST & Transport actions to support SAML single signon / signout - Tests for above - More XML than you ever wanted to see. Original commit: elastic/x-pack-elasticsearch@b0fe7bb6528e02de11dce392e498efb8dde150a4
2018-01-20 17:43:00 -05:00
Switch SAML QA test to use a standalone cluster (elastic/x-pack-elasticsearch#3743) Introduce a healthy dose of reality into the SAML integration tests. Switches the test class from *Tests to *IT, and updates the build to run it during integTest Original commit: elastic/x-pack-elasticsearch@edd2538e5fb8486c557a657ec5d503c3d1c73ab0
2018-01-30 07:03:04 -05:00
integTestCluster {
use generated license in qa test, see elastic/x-pack-elasticsearch#3878 Original commit: elastic/x-pack-elasticsearch@9a32eab685dc795eae59183f1e202fb911084d73
2018-02-13 06:16:53 -05:00
setting 'xpack.license.self_generated.type', 'trial'
Disable security for trial licenses by default (elastic/x-pack-elasticsearch#4120) This change disables security for trial licenses unless security is explicitly enabled in the settings. This is done to facilitate users getting started and not having to deal with some of the complexities involved in getting security configured. In order to do this and avoid disabling security for existing users that have gold or platinum licenses, we have to disable security after cluster formation so that the license can be retrieved. relates elastic/x-pack-elasticsearch#4078 Original commit: elastic/x-pack-elasticsearch@96bdb889fc74d4871c43df71354a21549cc53a3e
2018-03-21 23:09:44 -04:00
setting 'xpack.security.enabled', 'true'
Switch SAML QA test to use a standalone cluster (elastic/x-pack-elasticsearch#3743) Introduce a healthy dose of reality into the SAML integration tests. Switches the test class from *Tests to *IT, and updates the build to run it during integTest Original commit: elastic/x-pack-elasticsearch@edd2538e5fb8486c557a657ec5d503c3d1c73ab0
2018-01-30 07:03:04 -05:00
setting 'xpack.security.http.ssl.enabled', 'false'
setting 'xpack.security.authc.token.enabled', 'true'
Include realm type in Security Realm setting keys (#30241) This moves all Realm settings to an Affix definition. However, because different realm types define different settings (potentially conflicting settings) this requires that the realm type become part of the setting key. Thus, we now need to define realm settings as: xpack.security.authc.realms: file.file1: order: 0 native.native1: order: 1 - This is a breaking change to realm config - This is also a breaking change to custom security realms (SecurityExtension)
2018-11-05 22:56:50 -05:00
setting 'xpack.security.authc.realms.file.file.order', '0'
Add support for "authorization_realms" (#33262) Authorization Realms allow an authenticating realm to delegate the task of constructing a User object (with name, roles, etc) to one or more other realms. E.g. A client could authenticate using PKI, but then delegate to an LDAP realm. The LDAP realm performs a "lookup" by principal, and then does regular role-mapping from the discovered user. This commit includes: - authorization_realm support in the pki, ldap, saml & kerberos realms - docs for authorization_realms - checks that there are no "authorization chains" (whereby "realm-a" delegates to "realm-b", but "realm-b" delegates to "realm-c") Authorization realms is a platinum feature.
2018-08-30 23:25:27 -04:00
// SAML realm 1 (no authorization_realms)
Include realm type in Security Realm setting keys (#30241) This moves all Realm settings to an Affix definition. However, because different realm types define different settings (potentially conflicting settings) this requires that the realm type become part of the setting key. Thus, we now need to define realm settings as: xpack.security.authc.realms: file.file1: order: 0 native.native1: order: 1 - This is a breaking change to realm config - This is also a breaking change to custom security realms (SecurityExtension)
2018-11-05 22:56:50 -05:00
setting 'xpack.security.authc.realms.saml.shibboleth.order', '1'
setting 'xpack.security.authc.realms.saml.shibboleth.idp.entity_id', 'https://test.shibboleth.elastic.local/'
setting 'xpack.security.authc.realms.saml.shibboleth.idp.metadata.path', 'idp-metadata.xml'
setting 'xpack.security.authc.realms.saml.shibboleth.sp.entity_id', 'http://mock1.http.elastic.local/'
Switch SAML QA test to use a standalone cluster (elastic/x-pack-elasticsearch#3743) Introduce a healthy dose of reality into the SAML integration tests. Switches the test class from *Tests to *IT, and updates the build to run it during integTest Original commit: elastic/x-pack-elasticsearch@edd2538e5fb8486c557a657ec5d503c3d1c73ab0
2018-01-30 07:03:04 -05:00
// The port in the ACS URL is fake - the test will bind the mock webserver
// to a random port and then whenever it needs to connect to a URL on the
// mock webserver it will replace 54321 with the real port
Include realm type in Security Realm setting keys (#30241) This moves all Realm settings to an Affix definition. However, because different realm types define different settings (potentially conflicting settings) this requires that the realm type become part of the setting key. Thus, we now need to define realm settings as: xpack.security.authc.realms: file.file1: order: 0 native.native1: order: 1 - This is a breaking change to realm config - This is also a breaking change to custom security realms (SecurityExtension)
2018-11-05 22:56:50 -05:00
setting 'xpack.security.authc.realms.saml.shibboleth.sp.acs', 'http://localhost:54321/saml/acs1'
setting 'xpack.security.authc.realms.saml.shibboleth.attributes.principal', 'uid'
setting 'xpack.security.authc.realms.saml.shibboleth.attributes.name', 'urn:oid:2.5.4.3'
Add support for "authorization_realms" (#33262) Authorization Realms allow an authenticating realm to delegate the task of constructing a User object (with name, roles, etc) to one or more other realms. E.g. A client could authenticate using PKI, but then delegate to an LDAP realm. The LDAP realm performs a "lookup" by principal, and then does regular role-mapping from the discovered user. This commit includes: - authorization_realm support in the pki, ldap, saml & kerberos realms - docs for authorization_realms - checks that there are no "authorization chains" (whereby "realm-a" delegates to "realm-b", but "realm-b" delegates to "realm-c") Authorization realms is a platinum feature.
2018-08-30 23:25:27 -04:00
// SAML realm 2 (uses authorization_realms)
Include realm type in Security Realm setting keys (#30241) This moves all Realm settings to an Affix definition. However, because different realm types define different settings (potentially conflicting settings) this requires that the realm type become part of the setting key. Thus, we now need to define realm settings as: xpack.security.authc.realms: file.file1: order: 0 native.native1: order: 1 - This is a breaking change to realm config - This is also a breaking change to custom security realms (SecurityExtension)
2018-11-05 22:56:50 -05:00
setting 'xpack.security.authc.realms.saml.shibboleth_native.order', '2'
setting 'xpack.security.authc.realms.saml.shibboleth_native.idp.entity_id', 'https://test.shibboleth.elastic.local/'
setting 'xpack.security.authc.realms.saml.shibboleth_native.idp.metadata.path', 'idp-metadata.xml'
setting 'xpack.security.authc.realms.saml.shibboleth_native.sp.entity_id', 'http://mock2.http.elastic.local/'
setting 'xpack.security.authc.realms.saml.shibboleth_native.sp.acs', 'http://localhost:54321/saml/acs2'
setting 'xpack.security.authc.realms.saml.shibboleth_native.attributes.principal', 'uid'
setting 'xpack.security.authc.realms.saml.shibboleth_native.authorization_realms', 'native'
setting 'xpack.security.authc.realms.native.native.order', '3'
Add support for "authorization_realms" (#33262) Authorization Realms allow an authenticating realm to delegate the task of constructing a User object (with name, roles, etc) to one or more other realms. E.g. A client could authenticate using PKI, but then delegate to an LDAP realm. The LDAP realm performs a "lookup" by principal, and then does regular role-mapping from the discovered user. This commit includes: - authorization_realm support in the pki, ldap, saml & kerberos realms - docs for authorization_realms - checks that there are no "authorization chains" (whereby "realm-a" delegates to "realm-b", but "realm-b" delegates to "realm-c") Authorization realms is a platinum feature.
2018-08-30 23:25:27 -04:00
Switch SAML QA test to use a standalone cluster (elastic/x-pack-elasticsearch#3743) Introduce a healthy dose of reality into the SAML integration tests. Switches the test class from *Tests to *IT, and updates the build to run it during integTest Original commit: elastic/x-pack-elasticsearch@edd2538e5fb8486c557a657ec5d503c3d1c73ab0
2018-01-30 07:03:04 -05:00
setting 'xpack.ml.enabled', 'false'
Replace Vagrant with Docker for idp-fixture (#39948) The change replaces the Vagrant box based fixture with a fixture based on docker compose and 2 docker images, one for an openldap server and one for a Shibboleth SAML Identity Provider. The configuration of both openldap and shibboleth is identical to the previous one, in order to minimize required changes in the tests
2019-03-12 17:54:23 -04:00
extraConfigFile 'idp-metadata.xml', idpFixtureProject.file("idp/shibboleth-idp/metadata/idp-metadata.xml")
Switch SAML QA test to use a standalone cluster (elastic/x-pack-elasticsearch#3743) Introduce a healthy dose of reality into the SAML integration tests. Switches the test class from *Tests to *IT, and updates the build to run it during integTest Original commit: elastic/x-pack-elasticsearch@edd2538e5fb8486c557a657ec5d503c3d1c73ab0
2018-01-30 07:03:04 -05:00
setupCommand 'setupTestAdmin',
Rename users This commit renames users to elasticsearch-users.
2018-04-11 11:36:12 -04:00
'bin/elasticsearch-users', 'useradd', "test_admin", '-p', 'x-pack-test-password', '-r', "superuser"
Switch SAML QA test to use a standalone cluster (elastic/x-pack-elasticsearch#3743) Introduce a healthy dose of reality into the SAML integration tests. Switches the test class from *Tests to *IT, and updates the build to run it during integTest Original commit: elastic/x-pack-elasticsearch@edd2538e5fb8486c557a657ec5d503c3d1c73ab0
2018-01-30 07:03:04 -05:00
waitCondition = { node, ant ->
File tmpFile = new File(node.cwd, 'wait.success')
ant.get(src: "http://${node.httpUri()}/_cluster/health?wait_for_nodes=>=${numNodes}&wait_for_status=yellow",
dest: tmpFile.toString(),
username: 'test_admin',
password: 'x-pack-test-password',
ignoreerrors: true,
retries: 10)
return tmpFile.exists()
}
[Security] Add SAML authentication support (elastic/x-pack-elasticsearch#3646) Introduces: - SAML Realm - REST & Transport actions to support SAML single signon / signout - Tests for above - More XML than you ever wanted to see. Original commit: elastic/x-pack-elasticsearch@b0fe7bb6528e02de11dce392e498efb8dde150a4
2018-01-20 17:43:00 -05:00
}
forbiddenPatterns {
exclude '**/*.der'
exclude '**/*.p12'
exclude '**/*.key'
}
Split third party audit exclusions by type (#36763)
2019-01-07 10:24:19 -05:00
thirdPartyAudit {
ignoreViolations (
// uses internal java api: sun.misc.Unsafe
'com.google.common.cache.Striped64',
'com.google.common.cache.Striped64$1',
'com.google.common.cache.Striped64$Cell',
'com.google.common.primitives.UnsignedBytes$LexicographicalComparatorHolder$UnsafeComparator',
'com.google.common.primitives.UnsignedBytes$LexicographicalComparatorHolder$UnsafeComparator$1',
'com.google.common.util.concurrent.AbstractFuture$UnsafeAtomicHelper',
'com.google.common.util.concurrent.AbstractFuture$UnsafeAtomicHelper$1'
)
ignoreMissingClasses (
'com.ibm.icu.lang.UCharacter'
)
}