FTR configurable test users

docs/developer/core/development-functional-tests.asciidoc

@@ -178,6 +178,25 @@ To run tests on Firefox locally, use `config.firefox.js`:
 node scripts/functional_test_runner --config test/functional/config.firefox.js
 -----------
 
+[float]
+===== Using the test_user service
+
+Tests should run at the positive security boundry condition, meaning that they should be run with the mimimum privileges required (and documented) and not as the superuser.
+ This prevents the type of regression where additional privleges accidentally become required to perform the same action. 
+
+The functional UI tests now default to logging in with a user named `test_user` and the roles of this user can be changed dynamically without logging in and out.  
+
+In order to achieve this a new service was introduced called `createTestUserService` (see `test/common/services/security/test_user.ts`). The purpose of this test user service is to create roles defined in the test config files and setRoles() or restoreDefaults().
+
+An example of how to set the role like how its defined below:
+
+`await security.testUser.setRoles(['kibana_user', 'kibana_date_nanos']);`
+
+Here we are setting the `test_user` to have the `kibana_user` role and also role access to a specific data index (`kibana_date_nanos`).
+
+Tests should normally setRoles() in the before() and restoreDefaults() in the after().
+
+
 [float]
 ===== Anatomy of a test file
 

packages/kbn-test/src/functional_test_runner/lib/config/schema.ts

@@ -248,5 +248,20 @@ export const schema = Joi.object()
         fixedHeaderHeight: Joi.number().default(50),
       })
       .default(),
+
+    // settings for the security service if there is no defaultRole defined, then default to superuser role.
+    security: Joi.object()
+      .keys({
+        roles: Joi.object().default(),
+        defaultRoles: Joi.array()
+          .items(Joi.string())
+          .when('$primary', {
+            is: true,
+            then: Joi.array().min(1),
+          })
+          .default(['superuser']),
+        disableTestUser: Joi.boolean(),
+      })
+      .default(),
   })
   .default();

src/plugins/advanced_settings/public/management_app/components/field/field.tsx

@@ -370,6 +370,7 @@ export class Field extends PureComponent<FieldProps> {
               ref={this.changeImageForm}
               fullWidth
               data-test-subj={`advancedSetting-editField-${name}`}
+              aria-label={id}
             />
           );
         }

test/accessibility/apps/discover.ts

@@ -25,13 +25,7 @@ export default function({ getService, getPageObjects }: FtrProviderContext) {
   const esArchiver = getService('esArchiver');
   const kibanaServer = getService('kibanaServer');
   const inspector = getService('inspector');
-  const docTable = getService('docTable');
   const filterBar = getService('filterBar');
-  const TEST_COLUMN_NAMES = ['@message'];
-  const TEST_FILTER_COLUMN_NAMES = [
-    ['extension', 'jpg'],
-    ['geo.src', 'IN'],
-  ];
 
   describe('Discover', () => {
     before(async () => {
@@ -63,6 +57,7 @@ export default function({ getService, getPageObjects }: FtrProviderContext) {
       await a11y.testAppSnapshot();
     });
 
+    // skipping the test for new because we can't fix it right now
     it.skip('Click on new to clear the search', async () => {
       await PageObjects.discover.clickNewSearchButton();
       await a11y.testAppSnapshot();
@@ -99,6 +94,7 @@ export default function({ getService, getPageObjects }: FtrProviderContext) {
       await a11y.testAppSnapshot();
     });
 
+    // unable to validate on EUI pop-over
     it('click share button', async () => {
       await PageObjects.share.clickShareTopNavButton();
       await a11y.testAppSnapshot();
@@ -113,29 +109,5 @@ export default function({ getService, getPageObjects }: FtrProviderContext) {
       await PageObjects.discover.closeSidebarFieldFilter();
       await a11y.testAppSnapshot();
     });
-
-    it('Add a field from sidebar', async () => {
-      for (const columnName of TEST_COLUMN_NAMES) {
-        await PageObjects.discover.clickFieldListItemAdd(columnName);
-      }
-      await a11y.testAppSnapshot();
-    });
-
-    it.skip('Add more fields from sidebar', async () => {
-      for (const [columnName, value] of TEST_FILTER_COLUMN_NAMES) {
-        await PageObjects.discover.clickFieldListItem(columnName);
-        await PageObjects.discover.clickFieldListPlusFilter(columnName, value);
-      }
-      await a11y.testAppSnapshot();
-    });
-
-    // Context view test
-    it('should open context view on a doc', async () => {
-      await docTable.clickRowToggle();
-      await (await docTable.getRowActions())[0].click();
-      await a11y.testAppSnapshot();
-    });
-
-    // Adding rest of the tests after https://github.com/elastic/kibana/issues/53888 is resolved
   });
 }

test/common/services/security/role.ts

@@ -43,7 +43,6 @@ export class Role {
         `Expected status code of 204, received ${status} ${statusText}: ${util.inspect(data)}`
       );
     }
-    this.log.debug(`created role ${name}`);
   }
 
   public async delete(name: string) {
@@ -56,6 +55,5 @@ export class Role {
         )}`
       );
     }
-    this.log.debug(`deleted role ${name}`);
   }
 }

test/common/services/security/security.ts

@@ -23,15 +23,21 @@ import { Role } from './role';
 import { User } from './user';
 import { RoleMappings } from './role_mappings';
 import { FtrProviderContext } from '../../ftr_provider_context';
+import { createTestUserService } from './test_user';
 
-export function SecurityServiceProvider({ getService }: FtrProviderContext) {
+export async function SecurityServiceProvider(context: FtrProviderContext) {
+  const { getService } = context;
   const log = getService('log');
   const config = getService('config');
   const url = formatUrl(config.get('servers.kibana'));
+  const role = new Role(url, log);
+  const user = new User(url, log);
+  const testUser = await createTestUserService(role, user, context);
 
   return new (class SecurityService {
     role = new Role(url, log);
     roleMappings = new RoleMappings(url, log);
     user = new User(url, log);
+    testUser = testUser;
   })();
 }

test/common/services/security/test_user.ts

@@ -0,0 +1,94 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { Role } from './role';
+import { User } from './user';
+import { FtrProviderContext } from '../../ftr_provider_context';
+import { Browser } from '../../../functional/services/browser';
+import { TestSubjects } from '../../../functional/services/test_subjects';
+
+export async function createTestUserService(
+  role: Role,
+  user: User,
+  { getService, hasService }: FtrProviderContext
+) {
+  const log = getService('log');
+  const config = getService('config');
+  // @ts-ignore browser service is not normally available in common.
+  const browser: Browser | void = hasService('browser') && getService('browser');
+  const testSubjects: TestSubjects | void =
+    // @ts-ignore testSubject service is not normally available in common.
+    hasService('testSubjects') && getService('testSubjects');
+  const kibanaServer = getService('kibanaServer');
+
+  const enabledPlugins = config.get('security.disableTestUser')
+    ? []
+    : await kibanaServer.plugins.getEnabledIds();
+  const isEnabled = () => {
+    return enabledPlugins.includes('security') && !config.get('security.disableTestUser');
+  };
+  if (isEnabled()) {
+    log.debug(
+      '====================================================creating roles and users========================='
+    );
+    for (const [name, definition] of Object.entries(config.get('security.roles'))) {
+      // create the defined roles (need to map array to create roles)
+      await role.create(name, definition);
+    }
+    try {
+      // delete the test_user if present (will it error if the user doesn't exist?)
+      await user.delete('test_user');
+    } catch (exception) {
+      log.debug('no test user to delete');
+    }
+
+    // create test_user with username and pwd
+    log.debug(`default roles = ${config.get('security.defaultRoles')}`);
+    await user.create('test_user', {
+      password: 'changeme',
+      roles: config.get('security.defaultRoles'),
+      full_name: 'test user',
+    });
+  }
+
+  return new (class TestUser {
+    async restoreDefaults() {
+      if (isEnabled()) {
+        await this.setRoles(config.get('security.defaultRoles'));
+      }
+    }
+
+    async setRoles(roles: string[]) {
+      if (isEnabled()) {
+        log.debug(`set roles = ${roles}`);
+        await user.create('test_user', {
+          password: 'changeme',
+          roles,
+          full_name: 'test user',
+        });
+
+        if (browser && testSubjects) {
+          if (await testSubjects.exists('kibanaChrome')) {
+            await browser.refresh();
+            await testSubjects.find('kibanaChrome', config.get('timeouts.find') * 10);
+          }
+        }
+      }
+    }
+  })();
+}

test/functional/apps/context/_date_nanos.js

@@ -26,11 +26,13 @@ const TEST_STEP_SIZE = 3;
 export default function({ getService, getPageObjects }) {
   const kibanaServer = getService('kibanaServer');
   const docTable = getService('docTable');
+  const security = getService('security');
   const PageObjects = getPageObjects(['common', 'context', 'timePicker', 'discover']);
   const esArchiver = getService('esArchiver');
 
   describe('context view for date_nanos', () => {
     before(async function() {
+      await security.testUser.setRoles(['kibana_admin', 'kibana_date_nanos']);
       await esArchiver.loadIfNeeded('date_nanos');
       await kibanaServer.uiSettings.replace({ defaultIndex: TEST_INDEX_PATTERN });
       await kibanaServer.uiSettings.update({
@@ -39,8 +41,9 @@ export default function({ getService, getPageObjects }) {
       });
     });
 
-    after(function unloadMakelogs() {
-      return esArchiver.unload('date_nanos');
+    after(async function unloadMakelogs() {
+      await security.testUser.restoreDefaults();
+      await esArchiver.unload('date_nanos');
     });
 
     it('displays predessors - anchor - successors in right order ', async function() {

test/functional/apps/context/_date_nanos_custom_timestamp.js

@@ -26,12 +26,14 @@ const TEST_STEP_SIZE = 3;
 export default function({ getService, getPageObjects }) {
   const kibanaServer = getService('kibanaServer');
   const docTable = getService('docTable');
+  const security = getService('security');
   const PageObjects = getPageObjects(['common', 'context', 'timePicker', 'discover']);
   const esArchiver = getService('esArchiver');
   // skipped due to a recent change in ES that caused search_after queries with data containing
   // custom timestamp formats like in the testdata to fail
   describe.skip('context view for date_nanos with custom timestamp', () => {
     before(async function() {
+      await security.testUser.setRoles(['kibana_admin', 'kibana_date_nanos_custom']);
       await esArchiver.loadIfNeeded('date_nanos_custom');
       await kibanaServer.uiSettings.replace({ defaultIndex: TEST_INDEX_PATTERN });
       await kibanaServer.uiSettings.update({
@@ -40,10 +42,6 @@ export default function({ getService, getPageObjects }) {
       });
     });
 
-    after(function unloadMakelogs() {
-      return esArchiver.unload('date_nanos_custom');
-    });
-
     it('displays predessors - anchor - successors in right order ', async function() {
       await PageObjects.context.navigateTo(TEST_INDEX_PATTERN, '1');
       const actualRowsText = await docTable.getRowsText();
@@ -54,5 +52,10 @@ export default function({ getService, getPageObjects }) {
       ];
       expect(actualRowsText).to.eql(expectedRowsText);
     });
+
+    after(async function() {
+      await security.testUser.restoreDefaults();
+      await esArchiver.unload('date_nanos_custom');
+    });
   });
 }

test/functional/apps/dashboard/dashboard_filtering.js

@@ -33,6 +33,7 @@ export default function({ getService, getPageObjects }) {
   const filterBar = getService('filterBar');
   const esArchiver = getService('esArchiver');
   const kibanaServer = getService('kibanaServer');
+  const security = getService('security');
   const dashboardPanelActions = getService('dashboardPanelActions');
   const PageObjects = getPageObjects(['common', 'dashboard', 'header', 'visualize', 'timePicker']);
 
@@ -41,6 +42,7 @@ export default function({ getService, getPageObjects }) {
 
     before(async () => {
       await esArchiver.load('dashboard/current/kibana');
+      await security.testUser.setRoles(['kibana_admin', 'test_logstash_reader', 'animals']);
       await kibanaServer.uiSettings.replace({
         defaultIndex: '0bf35f60-3dc9-11e8-8660-4d65aa086b3c',
       });

test/functional/apps/dashboard/index.js

@@ -23,6 +23,7 @@ export default function({ getService, loadTestFile }) {
 
   async function loadCurrentData() {
     await browser.setWindowSize(1300, 900);
+    await esArchiver.unload('logstash_functional');
     await esArchiver.loadIfNeeded('dashboard/current/data');
   }
 

test/functional/apps/dashboard/time_zones.js

@@ -22,7 +22,6 @@ import expect from '@kbn/expect';
 
 export default function({ getService, getPageObjects }) {
   const pieChart = getService('pieChart');
-  const browser = getService('browser');
   const esArchiver = getService('esArchiver');
   const kibanaServer = getService('kibanaServer');
   const PageObjects = getPageObjects(['dashboard', 'timePicker', 'settings', 'common']);
@@ -48,7 +47,6 @@ export default function({ getService, getPageObjects }) {
 
     after(async () => {
       await kibanaServer.uiSettings.replace({ 'dateFormat:tz': 'UTC' });
-      await browser.refresh();
     });
 
     it('Exported dashboard adjusts EST time to UTC', async () => {