mirror of
https://github.com/honeymoose/OpenSearch.git
synced 2025-02-06 13:08:29 +00:00
500b4ac6b9
The changes made for elastic/x-pack-elasticsearch#2369 showed that the ML security tests were seriously weakened by the decision to grant many "minimal" privileges to all users involved in the tests. A better solution is to override the auth header such that a superuser runs setup actions and assertions that work by querying raw documents in ways that an end user wouldn't. Then the ML endpoints can be called with the privileges provided by the ML roles and nothing else. Original commit: elastic/x-pack-elasticsearch@4de42d9e54
96 lines
5.1 KiB
Groovy
96 lines
5.1 KiB
Groovy
apply plugin: 'elasticsearch.standalone-rest-test'
|
|
apply plugin: 'elasticsearch.rest-test'
|
|
|
|
dependencies {
|
|
testCompile project(path: ':x-pack-elasticsearch:plugin', configuration: 'runtime')
|
|
testCompile project(path: ':x-pack-elasticsearch:plugin', configuration: 'testArtifacts')
|
|
}
|
|
|
|
// bring in machine learning rest test suite
|
|
task copyMlRestTests(type: Copy) {
|
|
into project.sourceSets.test.output.resourcesDir
|
|
from project(':x-pack-elasticsearch:plugin').sourceSets.test.resources.srcDirs
|
|
include 'rest-api-spec/test/ml/**'
|
|
}
|
|
|
|
integTestRunner {
|
|
systemProperty 'tests.rest.blacklist', [
|
|
// Remove tests that are expected to throw an exception, because we cannot then
|
|
// know whether to expect an authorization exception or a validation exception
|
|
'ml/custom_all_field/Test querying custom all field',
|
|
'ml/datafeeds_crud/Test delete datafeed with missing id',
|
|
'ml/datafeeds_crud/Test put datafeed referring to missing job_id',
|
|
'ml/datafeeds_crud/Test put datafeed with invalid query',
|
|
'ml/datafeeds_crud/Test update datafeed with missing id',
|
|
'ml/delete_job_force/Test cannot force delete a non-existent job',
|
|
'ml/delete_model_snapshot/Test delete snapshot missing snapshotId',
|
|
'ml/delete_model_snapshot/Test delete snapshot missing job_id',
|
|
'ml/delete_model_snapshot/Test delete with in-use model',
|
|
'ml/filter_crud/Test create filter api with mismatching body ID',
|
|
'ml/filter_crud/Test get filter API with bad ID',
|
|
'ml/filter_crud/Test invalid param combinations',
|
|
'ml/filter_crud/Test non-existing filter',
|
|
'ml/get_datafeed_stats/Test get datafeed stats given missing datafeed_id',
|
|
'ml/get_datafeeds/Test get datafeed given missing datafeed_id',
|
|
'ml/jobs_crud/Test cannot create job with existing categorizer state document',
|
|
'ml/jobs_crud/Test cannot create job with existing quantiles document',
|
|
'ml/jobs_crud/Test cannot create job with existing result document',
|
|
'ml/jobs_crud/Test cannot create job with model snapshot id set',
|
|
'ml/jobs_crud/Test get job API with non existing job id',
|
|
'ml/jobs_crud/Test put job after closing results index',
|
|
'ml/jobs_crud/Test put job after closing state index',
|
|
'ml/jobs_crud/Test put job with inconsistent body/param ids',
|
|
'ml/jobs_crud/Test put job with time field in analysis_config',
|
|
'ml/jobs_get/Test get job given missing job_id',
|
|
'ml/jobs_get_result_buckets/Test mutually-exclusive params',
|
|
'ml/jobs_get_result_buckets/Test mutually-exclusive params via body',
|
|
'ml/jobs_get_result_categories/Test with invalid param combinations',
|
|
'ml/jobs_get_result_categories/Test with invalid param combinations via body',
|
|
'ml/jobs_get_stats/Test get job stats given missing job',
|
|
'ml/jobs_get_stats/Test no exception on get job stats with missing index',
|
|
'ml/job_groups/Test put job with empty group',
|
|
'ml/job_groups/Test put job with group that matches an job id',
|
|
'ml/job_groups/Test put job with group that matches its id',
|
|
'ml/job_groups/Test put job with id that matches an existing group',
|
|
'ml/job_groups/Test put job with invalid group',
|
|
'ml/post_data/Test Flush data with invalid parameters',
|
|
'ml/post_data/Test flushing and posting a closed job',
|
|
'ml/post_data/Test open and close with non-existent job id',
|
|
'ml/post_data/Test POST data with invalid parameters',
|
|
'ml/preview_datafeed/Test preview missing datafeed',
|
|
'ml/revert_model_snapshot/Test revert model with invalid snapshotId',
|
|
'ml/start_stop_datafeed/Test start datafeed job, but not open',
|
|
'ml/start_stop_datafeed/Test start non existing datafeed',
|
|
'ml/start_stop_datafeed/Test stop non existing datafeed',
|
|
'ml/update_model_snapshot/Test without description',
|
|
'ml/validate/Test invalid job config',
|
|
'ml/validate/Test job config is invalid because model snapshot id set',
|
|
'ml/validate/Test job config that is invalid only because of the job ID',
|
|
'ml/validate_detector/Test invalid detector'
|
|
].join(',')
|
|
}
|
|
|
|
integTestCluster {
|
|
dependsOn copyMlRestTests
|
|
plugin ':x-pack-elasticsearch:plugin'
|
|
extraConfigFile 'x-pack/roles.yml', 'roles.yml'
|
|
setupCommand 'setupTestAdminUser',
|
|
'bin/x-pack/users', 'useradd', 'x_pack_rest_user', '-p', 'x-pack-test-password', '-r', 'superuser'
|
|
setupCommand 'setupMlAdminUser',
|
|
'bin/x-pack/users', 'useradd', 'ml_admin', '-p', 'x-pack-test-password', '-r', 'minimal,machine_learning_admin'
|
|
setupCommand 'setupMlUserUser',
|
|
'bin/x-pack/users', 'useradd', 'ml_user', '-p', 'x-pack-test-password', '-r', 'minimal,machine_learning_user'
|
|
setupCommand 'setupPowerlessUser',
|
|
'bin/x-pack/users', 'useradd', 'no_ml', '-p', 'x-pack-test-password', '-r', 'minimal'
|
|
waitCondition = { node, ant ->
|
|
File tmpFile = new File(node.cwd, 'wait.success')
|
|
ant.get(src: "http://${node.httpUri()}/_cluster/health?wait_for_nodes=>=${numNodes}&wait_for_status=yellow",
|
|
dest: tmpFile.toString(),
|
|
username: 'x_pack_rest_user',
|
|
password: 'x-pack-test-password',
|
|
ignoreerrors: true,
|
|
retries: 10)
|
|
return tmpFile.exists()
|
|
}
|
|
}
|