[Test] Add Monitoring Bulk API REST tests with privileges (elastic/x-pack-elasticsearch#968)
This commit removes the smoke-test-monitoring-with-security project and replaces it with a REST test. Original commit: elastic/x-pack-elasticsearch@f1665815c2
This commit is contained in:
Tanguy Leroux
GitHub
parent
07a99c4792
commit
6396edc6a7
|
|
@ -0,0 +1,140 @@
|
||||||
|
---
|
||||||
|
setup:
|
||||||
|
- skip:
|
||||||
|
features: headers
|
||||||
|
- do:
|
||||||
|
cluster.health:
|
||||||
|
wait_for_status: yellow
|
||||||
|
|
||||||
|
# Creates a role and a user "Logstash Agent" who can use
|
||||||
|
# the Monitoring Bulk API and read the monitoring indices.
|
||||||
|
- do:
|
||||||
|
xpack.security.put_role:
|
||||||
|
name: "logstash_agent_role"
|
||||||
|
body: >
|
||||||
|
{
|
||||||
|
"cluster": ["cluster:admin/xpack/monitoring/bulk"],
|
||||||
|
"indices": [
|
||||||
|
{
|
||||||
|
"privileges": ["read"],
|
||||||
|
"names": ".monitoring-*"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
- do:
|
||||||
|
xpack.security.put_user:
|
||||||
|
username: "logstash_agent"
|
||||||
|
body: >
|
||||||
|
{
|
||||||
|
"password": "s3krit",
|
||||||
|
"roles" : [ "logstash_agent_role" ]
|
||||||
|
}
|
||||||
|
|
||||||
|
# Creates a role and a user "Unknown Agent" who can only
|
||||||
|
# read the monitoring indices.
|
||||||
|
- do:
|
||||||
|
xpack.security.put_role:
|
||||||
|
name: "unkown_agent_role"
|
||||||
|
body: >
|
||||||
|
{
|
||||||
|
"cluster": ["monitor"],
|
||||||
|
"indices": [
|
||||||
|
{
|
||||||
|
"privileges": ["read"],
|
||||||
|
"names": ".monitoring-*"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
- do:
|
||||||
|
xpack.security.put_user:
|
||||||
|
username: "unknown_agent"
|
||||||
|
body: >
|
||||||
|
{
|
||||||
|
"password": "s3krit",
|
||||||
|
"roles" : [ "unkown_agent_role" ]
|
||||||
|
}
|
||||||
|
|
||||||
|
---
|
||||||
|
teardown:
|
||||||
|
- do:
|
||||||
|
xpack.security.delete_user:
|
||||||
|
username: "logstash_agent"
|
||||||
|
ignore: 404
|
||||||
|
- do:
|
||||||
|
xpack.security.delete_role:
|
||||||
|
name: "logstash_agent_role"
|
||||||
|
ignore: 404
|
||||||
|
- do:
|
||||||
|
xpack.security.delete_user:
|
||||||
|
username: "unknown_agent"
|
||||||
|
ignore: 404
|
||||||
|
- do:
|
||||||
|
xpack.security.delete_role:
|
||||||
|
name: "unkown_agent_role"
|
||||||
|
ignore: 404
|
||||||
|
|
||||||
|
---
|
||||||
|
"Monitoring Bulk API":
|
||||||
|
- skip:
|
||||||
|
features: catch_unauthorized
|
||||||
|
|
||||||
|
- do:
|
||||||
|
headers:
|
||||||
|
# Authorization: logstash_agent
|
||||||
|
Authorization: "Basic bG9nc3Rhc2hfYWdlbnQ6czNrcml0"
|
||||||
|
xpack.monitoring.bulk:
|
||||||
|
system_id: "logstash"
|
||||||
|
system_api_version: "2"
|
||||||
|
interval: "10s"
|
||||||
|
body:
|
||||||
|
- index:
|
||||||
|
_type: logstash_metric
|
||||||
|
- metric:
|
||||||
|
queue: 10
|
||||||
|
- index:
|
||||||
|
_index: _data
|
||||||
|
_type: logstash_info
|
||||||
|
- info:
|
||||||
|
license: basic
|
||||||
|
- is_false: errors
|
||||||
|
|
||||||
|
- do:
|
||||||
|
indices.refresh: {}
|
||||||
|
|
||||||
|
- do:
|
||||||
|
search:
|
||||||
|
index: .monitoring-logstash-*
|
||||||
|
type: logstash_metric
|
||||||
|
- match: { hits.total: 1 }
|
||||||
|
|
||||||
|
- do:
|
||||||
|
search:
|
||||||
|
index: .monitoring-data-*
|
||||||
|
type: logstash_info
|
||||||
|
- match: { hits.total: 1 }
|
||||||
|
|
||||||
|
- do:
|
||||||
|
catch: forbidden
|
||||||
|
headers:
|
||||||
|
# Authorization: unknown_agent
|
||||||
|
Authorization: "Basic dW5rbm93bl9hZ2VudDpzM2tyaXQ="
|
||||||
|
xpack.monitoring.bulk:
|
||||||
|
system_id: "logstash"
|
||||||
|
system_api_version: "2"
|
||||||
|
interval: "10s"
|
||||||
|
body:
|
||||||
|
- index:
|
||||||
|
_type: logstash_metric
|
||||||
|
- metric:
|
||||||
|
queue: 10
|
||||||
|
- match: { "error.type": "security_exception" }
|
||||||
|
- match: { "error.reason": "action [cluster:admin/xpack/monitoring/bulk] is unauthorized for user [unknown_agent]" }
|
||||||
|
|
||||||
|
- do:
|
||||||
|
indices.refresh: {}
|
||||||
|
|
||||||
|
- do:
|
||||||
|
search:
|
||||||
|
index: .monitoring-logstash-*
|
||||||
|
type: logstash_metric
|
||||||
|
- match: { hits.total: 1 }
|
||||||
|
|
@ -1,50 +0,0 @@
|
||||||
subprojects {
|
|
||||||
apply plugin: 'elasticsearch.standalone-rest-test'
|
|
||||||
apply plugin: 'elasticsearch.rest-test'
|
|
||||||
|
|
||||||
dependencies {
|
|
||||||
testCompile project(path: ':x-pack-elasticsearch:plugin', configuration: 'runtime')
|
|
||||||
}
|
|
||||||
|
|
||||||
// bring in monitoring rest test suite
|
|
||||||
task copyMonitoringRestTests(type: Copy) {
|
|
||||||
into project.sourceSets.test.output.resourcesDir
|
|
||||||
from project(':x-pack-elasticsearch:plugin').sourceSets.test.resources.srcDirs
|
|
||||||
include 'rest-api-spec/test/monitoring/**'
|
|
||||||
}
|
|
||||||
|
|
||||||
integTest {
|
|
||||||
dependsOn copyMonitoringRestTests
|
|
||||||
}
|
|
||||||
|
|
||||||
integTestCluster {
|
|
||||||
systemProperty 'es.logger.level', 'TRACE'
|
|
||||||
plugin ':x-pack-elasticsearch:plugin'
|
|
||||||
setting 'xpack.monitoring.collection.interval', '3s'
|
|
||||||
extraConfigFile 'x-pack/roles.yml', '../roles.yml'
|
|
||||||
setupCommand 'setupTestAdminUser',
|
|
||||||
'bin/x-pack/users', 'useradd', 'test_admin', '-p', 'changeme', '-r', 'superuser'
|
|
||||||
setupCommand 'setupMonitoredSystemUser',
|
|
||||||
'bin/x-pack/users', 'useradd', 'monitoring_system', '-p', 'changeme', '-r', 'monitoring_system,monitoring_without_bulk'
|
|
||||||
setupCommand 'setupPowerlessUser',
|
|
||||||
'bin/x-pack/users', 'useradd', 'not_monitoring_system', '-p', 'changeme', '-r', 'monitoring_without_bulk'
|
|
||||||
|
|
||||||
waitCondition = { node, ant ->
|
|
||||||
File tmpFile = new File(node.cwd, 'wait.success')
|
|
||||||
ant.get(src: "http://${node.httpUri()}/_cluster/health?wait_for_nodes=>=${numNodes}&wait_for_status=yellow",
|
|
||||||
dest: tmpFile.toString(),
|
|
||||||
username: 'test_admin',
|
|
||||||
password: 'changeme',
|
|
||||||
ignoreerrors: true,
|
|
||||||
retries: 10)
|
|
||||||
return tmpFile.exists()
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Allow {@code integTest} to be invoked on this project to run both Monitoring+Security smoke tests.
|
|
||||||
*/
|
|
||||||
task integTest {
|
|
||||||
dependsOn subprojects.integTest
|
|
||||||
}
|
|
||||||
|
|
@ -1,61 +0,0 @@
|
||||||
/*
|
|
||||||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
|
||||||
* or more contributor license agreements. Licensed under the Elastic License;
|
|
||||||
* you may not use this file except in compliance with the Elastic License.
|
|
||||||
*/
|
|
||||||
package org.elasticsearch.smoketest;
|
|
||||||
|
|
||||||
import com.carrotsearch.randomizedtesting.annotations.Name;
|
|
||||||
import com.carrotsearch.randomizedtesting.annotations.ParametersFactory;
|
|
||||||
|
|
||||||
import org.elasticsearch.common.settings.Settings;
|
|
||||||
import org.elasticsearch.common.util.concurrent.ThreadContext;
|
|
||||||
import org.elasticsearch.test.rest.yaml.ClientYamlTestCandidate;
|
|
||||||
import org.elasticsearch.test.rest.yaml.ESClientYamlSuiteTestCase;
|
|
||||||
import org.elasticsearch.xpack.security.authc.support.SecuredString;
|
|
||||||
|
|
||||||
import java.io.IOException;
|
|
||||||
|
|
||||||
import static org.elasticsearch.xpack.security.authc.support.UsernamePasswordToken.basicAuthHeaderValue;
|
|
||||||
import static org.hamcrest.Matchers.containsString;
|
|
||||||
|
|
||||||
public class SmokeTestMonitoringWithSecurityClientYamlTestSuiteIT extends ESClientYamlSuiteTestCase {
|
|
||||||
|
|
||||||
public SmokeTestMonitoringWithSecurityClientYamlTestSuiteIT(@Name("yaml") ClientYamlTestCandidate testCandidate) {
|
|
||||||
super(testCandidate);
|
|
||||||
}
|
|
||||||
|
|
||||||
@ParametersFactory
|
|
||||||
public static Iterable<Object[]> parameters() throws IOException {
|
|
||||||
return ESClientYamlSuiteTestCase.createParameters();
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
protected Settings restClientSettings() {
|
|
||||||
String token = basicAuthHeaderValue("not_monitoring_system", new SecuredString("changeme".toCharArray()));
|
|
||||||
return Settings.builder()
|
|
||||||
.put(ThreadContext.PREFIX + ".Authorization", token)
|
|
||||||
.build();
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
protected Settings restAdminSettings() {
|
|
||||||
String token = basicAuthHeaderValue("test_admin", new SecuredString("changeme".toCharArray()));
|
|
||||||
return Settings.builder()
|
|
||||||
.put(ThreadContext.PREFIX + ".Authorization", token)
|
|
||||||
.build();
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public void test() throws IOException {
|
|
||||||
try {
|
|
||||||
super.test();
|
|
||||||
fail("should have failed because of missing role");
|
|
||||||
} catch(AssertionError ae) {
|
|
||||||
assertThat(ae.getMessage(), containsString("action [cluster:admin/xpack/monitoring/bulk]"));
|
|
||||||
assertThat(ae.getMessage(), containsString("returned [403 Forbidden]"));
|
|
||||||
assertThat(ae.getMessage(), containsString("is unauthorized for user [not_monitoring_system]"));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
monitoring_system:
|
|
||||||
cluster: [ 'cluster:admin/xpack/monitoring/bulk' ]
|
|
||||||
|
|
||||||
monitoring_without_bulk:
|
|
||||||
cluster: [ 'monitor' ]
|
|
||||||
indices:
|
|
||||||
- names: '.monitoring-*'
|
|
||||||
privileges:
|
|
||||||
- write
|
|
||||||
- read
|
|
||||||
- manage
|
|
||||||
|
|
@ -1,47 +0,0 @@
|
||||||
/*
|
|
||||||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
|
||||||
* or more contributor license agreements. Licensed under the Elastic License;
|
|
||||||
* you may not use this file except in compliance with the Elastic License.
|
|
||||||
*/
|
|
||||||
package org.elasticsearch.smoketest;
|
|
||||||
|
|
||||||
import com.carrotsearch.randomizedtesting.annotations.Name;
|
|
||||||
import com.carrotsearch.randomizedtesting.annotations.ParametersFactory;
|
|
||||||
|
|
||||||
import org.elasticsearch.common.settings.Settings;
|
|
||||||
import org.elasticsearch.common.util.concurrent.ThreadContext;
|
|
||||||
import org.elasticsearch.test.rest.yaml.ClientYamlTestCandidate;
|
|
||||||
import org.elasticsearch.test.rest.yaml.ESClientYamlSuiteTestCase;
|
|
||||||
import org.elasticsearch.xpack.security.authc.support.SecuredString;
|
|
||||||
|
|
||||||
import java.io.IOException;
|
|
||||||
|
|
||||||
import static org.elasticsearch.xpack.security.authc.support.UsernamePasswordToken.basicAuthHeaderValue;
|
|
||||||
|
|
||||||
public class SmokeTestMonitoringWithSecurityClientYamlTestSuiteIT extends ESClientYamlSuiteTestCase {
|
|
||||||
|
|
||||||
public SmokeTestMonitoringWithSecurityClientYamlTestSuiteIT(@Name("yaml") ClientYamlTestCandidate testCandidate) {
|
|
||||||
super(testCandidate);
|
|
||||||
}
|
|
||||||
|
|
||||||
@ParametersFactory
|
|
||||||
public static Iterable<Object[]> parameters() throws IOException {
|
|
||||||
return ESClientYamlSuiteTestCase.createParameters();
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
protected Settings restClientSettings() {
|
|
||||||
String token = basicAuthHeaderValue("monitoring_system", new SecuredString("changeme".toCharArray()));
|
|
||||||
return Settings.builder()
|
|
||||||
.put(ThreadContext.PREFIX + ".Authorization", token)
|
|
||||||
.build();
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
protected Settings restAdminSettings() {
|
|
||||||
String token = basicAuthHeaderValue("test_admin", new SecuredString("changeme".toCharArray()));
|
|
||||||
return Settings.builder()
|
|
||||||
.put(ThreadContext.PREFIX + ".Authorization", token)
|
|
||||||
.build();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
Loading…
Reference in New Issue