Skip to content

add MS Graph third party tests to periodic tests job #130380

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
richard-dennehy merged 4 commits into from
Jul 7, 2025
Merged

add MS Graph third party tests to periodic tests job #130380

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
33553e9
add MS Graph third party tests to periodic tests job
richard-dennehy Jun 30, 2025
140c703
update periodic pipeline config
richard-dennehy Jul 1, 2025
c75fd21
fix inconsistent group ID env var name
richard-dennehy Jul 7, 2025
0215fbc
Merge branch 'main' into ms-graph-thirdparty-tests
richard-dennehy Jul 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions .buildkite/pipelines/periodic.template.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -204,6 +204,17 @@ steps:
image: family/elasticsearch-ubuntu-2404
machineType: n2-standard-8
buildDirectory: /dev/shm/bk
- label: third-party / ms-graph
command: |
.ci/scripts/run-gradle.sh msGraphThirdPartyTest
env:
USE_3RD_PARTY_MS_GRAPH_CREDENTIALS: "true"
timeout_in_minutes: 30
agents:
provider: gcp
image: family/elasticsearch-ubuntu-2404
machineType: n2-standard-8
buildDirectory: /dev/shm/bk
- group: lucene-compat
steps:
- label: "{{matrix.LUCENE_VERSION}} / lucene-compat"
Expand Down
17 changes: 17 additions & 0 deletions .buildkite/scripts/third-party-test-credentials.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,23 @@ if [[ "${USE_3RD_PARTY_GCS_CREDENTIALS:-}" == "true" ]]; then
.buildkite/scripts/third-party-test-credentials.gcs.sh "$google_storage_service_account"
fi

if [[ "${USE_3RD_PARTY_MS_GRAPH_CREDENTIALS:-}" == "true" ]]; then
json=$(vault read -format=json secret/ci/elastic-elasticsearch/ms_graph_thirdparty_test_creds)

MS_GRAPH_TENANT_ID=$(echo "$json" | jq -r .data.tenant_id)
export ms_graph_tenant_id="$MS_GRAPH_TENANT_ID"

MS_GRAPH_CLIENT_ID=$(echo "$json" | jq -r .data.client_id)
export ms_graph_client_id="$MS_GRAPH_CLIENT_ID"

MS_GRAPH_CLIENT_SECRET=$(echo "$json" | jq -r .data.client_secret)
export ms_graph_client_secret="$MS_GRAPH_CLIENT_SECRET"

MS_GRAPH_USERNAME=$(echo "$json" | jq -r .data.username)
export ms_graph_username="$MS_GRAPH_USERNAME"

MS_GRAPH_GROUP_ID=$(echo "$json" | jq -r .data.group_id)
export ms_graph_group_id="$MS_GRAPH_GROUP_ID"
fi

unset json
27 changes: 27 additions & 0 deletions x-pack/plugin/security/qa/microsoft-graph-authz-tests/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,34 @@ dependencies {
clusterModules project(":modules:analysis-common")
}

boolean useFixture = false
String msGraphTenantId = System.getenv("ms_graph_tenant_id")
String msGraphClientId = System.getenv("ms_graph_client_id")
String msGraphClientSecret = System.getenv("ms_graph_client_secret")
String msGraphUsername = System.getenv("ms_graph_username")
String msGraphGroupId = System.getenv("ms_graph_groupid")

if (!msGraphTenantId || !msGraphClientId || !msGraphClientSecret || !msGraphUsername || !msGraphGroupId) {
msGraphTenantId = "tenant-id"
msGraphClientId = "client_id"
msGraphClientSecret = "client_secret"
msGraphUsername = "Thor"
msGraphGroupId = "test_group"
useFixture = true
}
Copy link
Contributor Author

@richard-dennehy richard-dennehy Jul 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

using a similar pattern to other third party tests

elasticsearch/modules/repository-azure/build.gradle

Lines 254 to 272 in e11d89d

boolean useFixture = false
String azureAccount = System.getenv("azure_storage_account")
String azureKey = System.getenv("azure_storage_key")
String azureContainer = System.getenv("azure_storage_container")
String azureBasePath = System.getenv("azure_storage_base_path")
String azureSasToken = System.getenv("azure_storage_sas_token")
String azureTenantId = System.getenv("azure_storage_tenant_id")
String azureClientId = System.getenv("azure_storage_client_id")
if (!azureAccount && !azureKey && !azureContainer && !azureBasePath && !azureSasToken) {
azureAccount = 'azure_integration_test_account'
azureKey = 'YXp1cmVfaW50ZWdyYXRpb25fdGVzdF9rZXk=' // The key is "azure_integration_test_key" encoded using base64
azureContainer = 'container'
azureBasePath = ''
azureSasToken = ''
azureTenantId = ''
azureClientId = ''
useFixture = true
}


tasks.named("javaRestTest").configure {
systemProperty "test.ms_graph.fixture", useFixture
systemProperty "test.ms_graph.tenant_id", msGraphTenantId
systemProperty "test.ms_graph.client_id", msGraphClientId
systemProperty "test.ms_graph.client_secret", msGraphClientSecret
systemProperty "test.ms_graph.username", msGraphUsername
systemProperty "test.ms_graph.group_id", msGraphGroupId

// disable tests in FIPS mode as we need to use a custom truststore containing the certs used in MicrosoftGraphHttpFixture
buildParams.withFipsEnabledOnly(it)
}

tasks.register("msGraphThirdPartyTest") {
dependsOn "javaRestTest"
}
40 changes: 26 additions & 14 deletions ...st/java/org/elasticsearch/xpack/security/authz/microsoft/MicrosoftGraphAuthzPluginIT.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
import org.elasticsearch.common.settings.SecureString;
import org.elasticsearch.common.settings.Settings;
import org.elasticsearch.common.util.concurrent.ThreadContext;
import org.elasticsearch.core.Booleans;
import org.elasticsearch.core.PathUtils;
import org.elasticsearch.test.TestTrustStore;
import org.elasticsearch.test.XContentTestUtils;
Expand Down Expand Up @@ -51,11 +52,12 @@

public class MicrosoftGraphAuthzPluginIT extends ESRestTestCase {

private static final String TENANT_ID = "tenant-id";
private static final String CLIENT_ID = "client_id";
private static final String CLIENT_SECRET = "client_secret";
private static final String USERNAME = "Thor";
private static final String EXPECTED_GROUP = "test_group";
private static final String TENANT_ID = System.getProperty("test.ms_graph.tenant_id");
private static final String CLIENT_ID = System.getProperty("test.ms_graph.client_id");
private static final String CLIENT_SECRET = System.getProperty("test.ms_graph.client_secret");
private static final String USERNAME = System.getProperty("test.ms_graph.username");
private static final String EXPECTED_GROUP = System.getProperty("test.ms_graph.group_id");
private static final Boolean USE_FIXTURE = Booleans.parseBoolean(System.getProperty("test.ms_graph.fixture"));

private static final List<MicrosoftGraphHttpFixture.TestUser> TEST_USERS = List.of(
new MicrosoftGraphHttpFixture.TestUser(
Expand Down Expand Up @@ -90,12 +92,14 @@ public class MicrosoftGraphAuthzPluginIT extends ESRestTestCase {
);

@ClassRule
public static TestRule ruleChain = RuleChain.outerRule(graphFixture).around(trustStore).around(cluster);
public static TestRule ruleChain = USE_FIXTURE
? RuleChain.outerRule(graphFixture).around(trustStore).around(cluster)
: RuleChain.outerRule(cluster);

private static final String IDP_ENTITY_ID = "http://idp.example.org/";

private static ElasticsearchCluster initTestCluster() {
return ElasticsearchCluster.local()
final var clusterBuilder = ElasticsearchCluster.local()
.module("analysis-common")
.setting("xpack.security.enabled", "true")
.setting("xpack.license.self_generated.type", "trial")
Expand All @@ -118,15 +122,22 @@ private static ElasticsearchCluster initTestCluster() {
.setting("xpack.security.authc.realms.microsoft_graph.microsoft_graph1.client_id", CLIENT_ID)
.keystore("xpack.security.authc.realms.microsoft_graph.microsoft_graph1.client_secret", CLIENT_SECRET)
.setting("xpack.security.authc.realms.microsoft_graph.microsoft_graph1.tenant_id", TENANT_ID)
.setting("xpack.security.authc.realms.microsoft_graph.microsoft_graph1.graph_host", () -> graphFixture.getBaseUrl() + "/v1.0")
.setting("xpack.security.authc.realms.microsoft_graph.microsoft_graph1.access_token_host", graphFixture::getBaseUrl)
.setting("logger.org.elasticsearch.xpack.security.authz.microsoft", "TRACE")
.setting("logger.com.microsoft", "TRACE")
.setting("logger.com.azure", "TRACE")
.systemProperty("javax.net.ssl.trustStore", () -> trustStore.getTrustStorePath().toString())
.systemProperty("javax.net.ssl.trustStoreType", "jks")
.systemProperty("tests.azure.credentials.disable_instance_discovery", "true")
.build();
.setting("logger.com.azure", "TRACE");

if (USE_FIXTURE) {
clusterBuilder.setting(
"xpack.security.authc.realms.microsoft_graph.microsoft_graph1.graph_host",
() -> graphFixture.getBaseUrl() + "/v1.0"
)
.setting("xpack.security.authc.realms.microsoft_graph.microsoft_graph1.access_token_host", graphFixture::getBaseUrl)
Comment on lines +131 to +134
Copy link
Contributor Author

@richard-dennehy richard-dennehy Jul 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

these settings have the correct default values, so the third party test shouldn't override them

.systemProperty("javax.net.ssl.trustStore", () -> trustStore.getTrustStorePath().toString())
.systemProperty("javax.net.ssl.trustStoreType", "jks")
.systemProperty("tests.azure.credentials.disable_instance_discovery", "true");
}

return clusterBuilder.build();
}

private static String getIDPMetadata() {
Expand Down Expand Up @@ -210,6 +221,7 @@ public void testAuthenticationSuccessful() throws Exception {
}

public void testConcurrentAuthentication() throws Exception {
assumeTrue("This needs the test server as the real account only has one user configured", USE_FIXTURE);
final var concurrentLogins = 3;

final var resultsListener = new PlainActionFuture<Collection<Map<String, Object>>>();
Expand Down
Loading