Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Ldap authentication #2212

Merged
merged 1 commit into from
Nov 28, 2022
Merged

Ldap authentication #2212

merged 1 commit into from
Nov 28, 2022

Conversation

lukasz-soszynski-eliatra
Copy link
Contributor

Description

[Describe what this change achieves]

  • Category (Integration tests)
  • Why these changes are required?
  • What is the old behaviour before changes and new behaviour after changes?

Integration tests related to LDAP authentication.

Issues Resolved

[List any issues this PR will resolve]

Is this a backport? If so, please add backport PR # and/or commits #

Testing

[Please provide details of testing done: unit testing, integration testing and manual testing]

Check List

  • New functionality includes testing
  • New functionality has been documented
  • Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

@lukasz-soszynski-eliatra lukasz-soszynski-eliatra requested a review from a team November 1, 2022 14:48
@codecov-commenter
Copy link

codecov-commenter commented Nov 1, 2022 •
edited

Codecov Report

Merging #2212 (20cc9de) into main (7cad5e4) will decrease coverage by 0.00%.
The diff coverage is n/a.

@@             Coverage Diff              @@
##               main    #2212      +/-   ##
============================================
- Coverage     61.05%   61.05%   -0.01%     
+ Complexity     3270     3268       -2     
============================================
  Files           259      259              
  Lines         18337    18337              
  Branches       3248     3248              
============================================
- Hits          11196    11195       -1     
- Misses         5555     5557       +2     
+ Partials       1586     1585       -1
Impacted Files Coverage Δ
...ecurity/configuration/ConfigurationRepository.java 72.13% <0.00%> (-2.19%) ⬇️
...iance/ComplianceIndexingOperationListenerImpl.java 61.76% <0.00%> (-1.48%) ⬇️
...nsearch/security/dlic/rest/api/AuditApiAction.java 68.08% <0.00%> (+4.25%) ⬆️
...ecurity/configuration/StaticResourceException.java 25.00% <0.00%> (+25.00%) ⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

@lukasz-soszynski-eliatra lukasz-soszynski-eliatra force-pushed the ldap-authentication branch 2 times, most recently from dc80aea to 181ac13 Compare November 2, 2022 14:09
DarshitChanpura
DarshitChanpura reviewed Nov 2, 2022
View reviewed changes
Copy link
Member

@DarshitChanpura DarshitChanpura left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ty @lukasz-soszynski-eliatra ! Added a few comments. Could you also add brief javadoc to the remaining new class that you have added as part of this PR?

src/integrationTest/java/org/opensearch/security/http/LdapAuthenticationTest.java Outdated
public static LocalCluster cluster = new LocalCluster.Builder()
.testCertificates(TEST_CERTIFICATES)
.clusterManager(ClusterManager.SINGLENODE).anonymousAuth(false)
.authc(new AuthcDomain("ldap", 2, true)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For my knowledge, why is order set to 2 here?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In order to insert the LDAP authentication domain after LDAP basic auth. The domain AUTHC_HTTPBASIC_INTERNAL contains an order equal to 0. I will refactor this to increase code readability.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code refactored in order to get rid of "magic number".

src/integrationTest/java/org/opensearch/security/http/UntrustedLdapServerCertificateTest.java Outdated Show resolved Hide resolved
src/integrationTest/java/org/opensearch/test/framework/ldap/EmbeddedLDAPServer.java Outdated Show resolved Hide resolved
src/integrationTest/java/org/opensearch/test/framework/ldap/LdapServer.java Show resolved Hide resolved
src/integrationTest/java/org/opensearch/test/framework/ldap/LdapServer.java Outdated Show resolved Hide resolved
@lukasz-soszynski-eliatra
Copy link
Contributor Author

I added tests related to LDAP and user impersonation: e0ceb8b

DarshitChanpura
DarshitChanpura previously approved these changes Nov 8, 2022
View reviewed changes
@DarshitChanpura
Copy link
Member

Bwc tests are broken on main. Tracking issue here: #2221

peternied
peternied reviewed Nov 10, 2022
View reviewed changes
src/integrationTest/resources/log4j2-test.properties Outdated
@@ -19,6 +19,10 @@ logger.testsecconfig.name=org.opensearch.test.framework.TestSecurityConfig
logger.testsecconfig.level = info
logger.localopensearchcluster.name=org.opensearch.test.framework.cluster.LocalOpenSearchCluster
logger.localopensearchcluster.level = info
<<<<<<< HEAD
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like a merge conflict was missed here

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removed

peternied
peternied reviewed Nov 10, 2022
View reviewed changes
Copy link
Member

@peternied peternied left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great contribution thank you

src/integrationTest/java/org/opensearch/security/http/LdapStartTlsAuthenticationTest.java

@RunWith(com.carrotsearch.randomizedtesting.RandomizedRunner.class)
@ThreadLeakScope(ThreadLeakScope.Scope.NONE)
public class LdapStartTlsAuthenticationTest {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add a comment on these test class for how its distinct from one another

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

src/integrationTest/java/org/opensearch/security/http/LdapTlsAuthenticationTest.java

HttpResponse response = client.getAuthInfo();

response.assertStatusCode(401);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Similar to previous pull request, can we modify these test cases to verify the expected error message by inspecting the log output to differentiate behavior between tests?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, LogsRule is already merged into the main branch.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually, I was wrong, the code used to verify log output in the tests is in the following PR https://github.com/opensearch-project/security/pull/2179/files#diff-d8906a1526f563012a51cf0203c4ed498a2299e41b91868b4b2658a59fcc7d26

I can move this code

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

src/integrationTest/java/org/opensearch/security/http/LdapTlsAuthenticationTest.java
response.assertStatusCode(200);
List<String> backendRoles = response.getTextArrayFromJsonBody(POINTER_BACKEND_ROLES);
assertThat(backendRoles, hasSize(2));
//CN_GROUP_CREW is retrieved recursively: cn=Jean,ou=people,o=test.org -> cn=bridge,ou=groups,o=test.org -> cn=crew,ou=groups,o=test.org
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great comment

src/integrationTest/java/org/opensearch/security/http/UntrustedLdapServerCertificateTest.java Outdated
TestRestClient.HttpResponse response = client.getAuthInfo();

response.assertStatusCode(401);
//TODO try to verify logs when JWT authentication tests are merged to main. Log should contain message like the below one
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Still working on this?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here I was waiting to merge PR https://github.com/opensearch-project/security/pull/2179/files#diff-d8906a1526f563012a51cf0203c4ed498a2299e41b91868b4b2658a59fcc7d26

But I can also move the code for logs verification :)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

@lukasz-soszynski-eliatra lukasz-soszynski-eliatra force-pushed the ldap-authentication branch 2 times, most recently from 29c3283 to b9f5d4b Compare November 11, 2022 10:55
DarshitChanpura
DarshitChanpura previously approved these changes Nov 18, 2022
View reviewed changes
Copy link
Member

@DarshitChanpura DarshitChanpura left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@lukasz-soszynski-eliatra
LDAP authentication tests.
20cc9de 
Signed-off-by: Lukasz Soszynski <lukasz.soszynski@eliatra.com>

Tests for roles recursive search for LDAP.

Signed-off-by: Lukasz Soszynski <lukasz.soszynski@eliatra.com>

User impersonation tests for LDAP authentication.

Signed-off-by: Lukasz Soszynski <lukasz.soszynski@eliatra.com>
@DarshitChanpura DarshitChanpura merged commit a578803 into opensearch-project:main Nov 28, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@peternied peternied peternied left review comments

@cwperks cwperks cwperks approved these changes

@DarshitChanpura DarshitChanpura DarshitChanpura approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
5 participants
@lukasz-soszynski-eliatra @codecov-commenter @DarshitChanpura @peternied @cwperks