Skip to content

Commit 2b3fcd1

Browse files
richard-dennehyrichard-dennehy
committed
add MS Graph third party tests to periodic tests job (elastic#130380)
1 parent a9cf685 commit 2b3fcd1

File tree

5 files changed

+93
-17
lines changed

5 files changed

+93
-17
lines changed

‎.buildkite/pipelines/periodic.template.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -209,6 +209,17 @@ steps:
209209
image: family/elasticsearch-ubuntu-2004
210210
machineType: n2-standard-8
211211
buildDirectory: /dev/shm/bk
212+
- label: third-party / ms-graph
213+
command: |
214+
.ci/scripts/run-gradle.sh msGraphThirdPartyTest
215+
env:
216+
USE_3RD_PARTY_MS_GRAPH_CREDENTIALS: "true"
217+
timeout_in_minutes: 30
218+
agents:
219+
provider: gcp
220+
image: family/elasticsearch-ubuntu-2404
221+
machineType: n2-standard-8
222+
buildDirectory: /dev/shm/bk
212223
- label: Upload Snyk Dependency Graph
213224
command: .ci/scripts/run-gradle.sh uploadSnykDependencyGraph -PsnykTargetReference=$BUILDKITE_BRANCH
214225
env:

‎.buildkite/pipelines/periodic.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -932,6 +932,17 @@ steps:
932932
image: family/elasticsearch-ubuntu-2004
933933
machineType: n2-standard-8
934934
buildDirectory: /dev/shm/bk
935+
- label: third-party / ms-graph
936+
command: |
937+
.ci/scripts/run-gradle.sh msGraphThirdPartyTest
938+
env:
939+
USE_3RD_PARTY_MS_GRAPH_CREDENTIALS: "true"
940+
timeout_in_minutes: 30
941+
agents:
942+
provider: gcp
943+
image: family/elasticsearch-ubuntu-2404
944+
machineType: n2-standard-8
945+
buildDirectory: /dev/shm/bk
935946
- label: Upload Snyk Dependency Graph
936947
command: .ci/scripts/run-gradle.sh uploadSnykDependencyGraph -PsnykTargetReference=$BUILDKITE_BRANCH
937948
env:

‎.buildkite/scripts/third-party-test-credentials.sh‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,23 @@ if [[ "${USE_3RD_PARTY_GCS_CREDENTIALS:-}" == "true" ]]; then
4646
.buildkite/scripts/third-party-test-credentials.gcs.sh "$google_storage_service_account"
4747
fi
4848

49+
if [[ "${USE_3RD_PARTY_MS_GRAPH_CREDENTIALS:-}" == "true" ]]; then
50+
json=$(vault read -format=json secret/ci/elastic-elasticsearch/ms_graph_thirdparty_test_creds)
4951

52+
MS_GRAPH_TENANT_ID=$(echo "$json" | jq -r .data.tenant_id)
53+
export ms_graph_tenant_id="$MS_GRAPH_TENANT_ID"
54+
55+
MS_GRAPH_CLIENT_ID=$(echo "$json" | jq -r .data.client_id)
56+
export ms_graph_client_id="$MS_GRAPH_CLIENT_ID"
57+
58+
MS_GRAPH_CLIENT_SECRET=$(echo "$json" | jq -r .data.client_secret)
59+
export ms_graph_client_secret="$MS_GRAPH_CLIENT_SECRET"
60+
61+
MS_GRAPH_USERNAME=$(echo "$json" | jq -r .data.username)
62+
export ms_graph_username="$MS_GRAPH_USERNAME"
63+
64+
MS_GRAPH_GROUP_ID=$(echo "$json" | jq -r .data.group_id)
65+
export ms_graph_group_id="$MS_GRAPH_GROUP_ID"
66+
fi
5067

5168
unset json

‎x-pack/plugin/security/qa/microsoft-graph-authz-tests/build.gradle‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,34 @@ dependencies {
88
clusterModules project(":modules:analysis-common")
99
}
1010

11+
boolean useFixture = false
12+
String msGraphTenantId = System.getenv("ms_graph_tenant_id")
13+
String msGraphClientId = System.getenv("ms_graph_client_id")
14+
String msGraphClientSecret = System.getenv("ms_graph_client_secret")
15+
String msGraphUsername = System.getenv("ms_graph_username")
16+
String msGraphGroupId = System.getenv("ms_graph_group_id")
17+
18+
if (!msGraphTenantId || !msGraphClientId || !msGraphClientSecret || !msGraphUsername || !msGraphGroupId) {
19+
msGraphTenantId = "tenant-id"
20+
msGraphClientId = "client_id"
21+
msGraphClientSecret = "client_secret"
22+
msGraphUsername = "Thor"
23+
msGraphGroupId = "test_group"
24+
useFixture = true
25+
}
26+
1127
tasks.named("javaRestTest").configure {
28+
systemProperty "test.ms_graph.fixture", useFixture
29+
systemProperty "test.ms_graph.tenant_id", msGraphTenantId
30+
systemProperty "test.ms_graph.client_id", msGraphClientId
31+
systemProperty "test.ms_graph.client_secret", msGraphClientSecret
32+
systemProperty "test.ms_graph.username", msGraphUsername
33+
systemProperty "test.ms_graph.group_id", msGraphGroupId
34+
1235
// disable tests in FIPS mode as we need to use a custom truststore containing the certs used in MicrosoftGraphHttpFixture
1336
buildParams.withFipsEnabledOnly(it)
1437
}
38+
39+
tasks.register("msGraphThirdPartyTest") {
40+
dependsOn "javaRestTest"
41+
}

‎x-pack/plugin/security/qa/microsoft-graph-authz-tests/src/javaRestTest/java/org/elasticsearch/xpack/security/authz/microsoft/MicrosoftGraphAuthzPluginIT.java‎

Lines changed: 27 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,12 @@
1717
import org.elasticsearch.common.settings.SecureString;
1818
import org.elasticsearch.common.settings.Settings;
1919
import org.elasticsearch.common.util.concurrent.ThreadContext;
20+
import org.elasticsearch.core.Booleans;
2021
import org.elasticsearch.core.PathUtils;
2122
import org.elasticsearch.test.TestTrustStore;
2223
import org.elasticsearch.test.XContentTestUtils;
2324
import org.elasticsearch.test.cluster.ElasticsearchCluster;
25+
import org.elasticsearch.test.cluster.local.LocalClusterSpecBuilder;
2426
import org.elasticsearch.test.cluster.local.model.User;
2527
import org.elasticsearch.test.cluster.util.resource.Resource;
2628
import org.elasticsearch.test.rest.ESRestTestCase;
@@ -51,11 +53,12 @@
5153

5254
public class MicrosoftGraphAuthzPluginIT extends ESRestTestCase {
5355

54-
private static final String TENANT_ID = "tenant-id";
55-
private static final String CLIENT_ID = "client_id";
56-
private static final String CLIENT_SECRET = "client_secret";
57-
private static final String USERNAME = "Thor";
58-
private static final String EXPECTED_GROUP = "test_group";
56+
private static final String TENANT_ID = System.getProperty("test.ms_graph.tenant_id");
57+
private static final String CLIENT_ID = System.getProperty("test.ms_graph.client_id");
58+
private static final String CLIENT_SECRET = System.getProperty("test.ms_graph.client_secret");
59+
private static final String USERNAME = System.getProperty("test.ms_graph.username");
60+
private static final String EXPECTED_GROUP = System.getProperty("test.ms_graph.group_id");
61+
private static final Boolean USE_FIXTURE = Booleans.parseBoolean(System.getProperty("test.ms_graph.fixture"));
5962

6063
private static final List<MicrosoftGraphHttpFixture.TestUser> TEST_USERS = List.of(
6164
new MicrosoftGraphHttpFixture.TestUser(
@@ -90,12 +93,14 @@ public class MicrosoftGraphAuthzPluginIT extends ESRestTestCase {
9093
);
9194

9295
@ClassRule
93-
public static TestRule ruleChain = RuleChain.outerRule(graphFixture).around(trustStore).around(cluster);
96+
public static TestRule ruleChain = USE_FIXTURE
97+
? RuleChain.outerRule(graphFixture).around(trustStore).around(cluster)
98+
: RuleChain.outerRule(cluster);
9499

95100
private static final String IDP_ENTITY_ID = "http://idp.example.org/";
96101

97102
private static ElasticsearchCluster initTestCluster() {
98-
return ElasticsearchCluster.local()
103+
final var clusterBuilder = ElasticsearchCluster.local()
99104
.module("analysis-common")
100105
.setting("xpack.security.enabled", "true")
101106
.setting("xpack.license.self_generated.type", "trial")
@@ -117,16 +122,20 @@ private static ElasticsearchCluster initTestCluster() {
117122
.setting("xpack.security.authc.realms.microsoft_graph.microsoft_graph1.order", "2")
118123
.setting("xpack.security.authc.realms.microsoft_graph.microsoft_graph1.client_id", CLIENT_ID)
119124
.keystore("xpack.security.authc.realms.microsoft_graph.microsoft_graph1.client_secret", CLIENT_SECRET)
120-
.setting("xpack.security.authc.realms.microsoft_graph.microsoft_graph1.tenant_id", TENANT_ID)
121-
.setting("xpack.security.authc.realms.microsoft_graph.microsoft_graph1.graph_host", () -> graphFixture.getBaseUrl() + "/v1.0")
122-
.setting("xpack.security.authc.realms.microsoft_graph.microsoft_graph1.access_token_host", graphFixture::getBaseUrl)
123-
.setting("logger.org.elasticsearch.xpack.security.authz.microsoft", "TRACE")
124-
.setting("logger.com.microsoft", "TRACE")
125-
.setting("logger.com.azure", "TRACE")
126-
.systemProperty("javax.net.ssl.trustStore", () -> trustStore.getTrustStorePath().toString())
127-
.systemProperty("javax.net.ssl.trustStoreType", "jks")
128-
.systemProperty("tests.azure.credentials.disable_instance_discovery", "true")
129-
.build();
125+
.setting("xpack.security.authc.realms.microsoft_graph.microsoft_graph1.tenant_id", TENANT_ID);
126+
127+
if (USE_FIXTURE) {
128+
clusterBuilder.setting(
129+
"xpack.security.authc.realms.microsoft_graph.microsoft_graph1.graph_host",
130+
() -> graphFixture.getBaseUrl() + "/v1.0"
131+
)
132+
.setting("xpack.security.authc.realms.microsoft_graph.microsoft_graph1.access_token_host", graphFixture::getBaseUrl)
133+
.systemProperty("javax.net.ssl.trustStore", () -> trustStore.getTrustStorePath().toString())
134+
.systemProperty("javax.net.ssl.trustStoreType", "jks")
135+
.systemProperty("tests.azure.credentials.disable_instance_discovery", "true");
136+
}
137+
138+
return clusterBuilder.build();
130139
}
131140

132141
private static String getIDPMetadata() {
@@ -205,6 +214,7 @@ public void testAuthenticationSuccessful() throws Exception {
205214
}
206215

207216
public void testConcurrentAuthentication() throws Exception {
217+
assumeTrue("This needs the test server as the real account only has one user configured", USE_FIXTURE);
208218
final var concurrentLogins = 3;
209219

210220
final var resultsListener = new PlainActionFuture<Collection<Map<String, Object>>>();

0 commit comments

Comments
 (0)