Test related to authentication with x.509 certificates. #2227
Conversation
lukasz-soszynski-eliatra
force-pushed
the
authentication-with-certificate-test
branch
from
5376435
to
de3f33f
Compare
Codecov Report
@@ Coverage Diff @@
## main #2227 +/- ##
============================================
- Coverage 61.04% 61.02% -0.02%
+ Complexity 3268 3267 -1
============================================
Files 259 259
Lines 18337 18336 -1
Branches 3248 3248
============================================
- Hits 11193 11190 -3
- Misses 5559 5561 +2
Partials 1585 1585
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. |
lukasz-soszynski-eliatra
force-pushed
the
authentication-with-certificate-test
branch
from
de3f33f
to
d08a524
Compare
|
Bwc tests are broken on main. Tracking issue here: #2221 |
lukasz-soszynski-eliatra
force-pushed
the
authentication-with-certificate-test
branch
2 times, most recently
from
fcd1fc7
to
bb5ac5c
Compare
Signed-off-by: Lukasz Soszynski <lukasz.soszynski@eliatra.com>
lukasz-soszynski-eliatra
force-pushed
the
authentication-with-certificate-test
branch
from
bb5ac5c
to
88eca16
Compare
There was a problem hiding this comment.
Thank you @lukasz-soszynski-eliatra, this looks good to me. There may be an opportunity to test a scenario with multiple backend roles, but I think this adds some nice coverage!
| } | ||
|
|
||
| @Test | ||
| public void shouldAuthenticateUserWithCertificate_positiveUserSpoke() { |
|
|
||
| private static final Map<String, Object> CERT_AUTH_CONFIG = Map.of( | ||
| "username_attribute", "cn", | ||
| "roles_attribute", "ou" |
There was a problem hiding this comment.
Interesting, I didn't know roles_attribute was possible with client cert authentication. I don't see documentation for this on the documentation website: https://opensearch.org/docs/latest/security-plugin/configuration/client-auth/
@cwillum, putting this on your radar to visit when client cert authentication is re-visited on the documentation website.
My understanding of Organizational Unit in LDAP is that it is conventionally used to model hierarchical structures of organizations. i.e. As a contributor the OpenSearch project concentrated on security, I may model a Distinguished name as:
L=NYC,CN=Craig,OU=OpenSearch,OU=Security,DC=opensearch,DC=org
Here it looks like we are using this as the list of backend roles and using that it is repeated as a convenience.
Description
[Describe what this change achieves]
Issues Resolved
[List any issues this PR will resolve]
Integration tests related to user authentication with X.509 certificates.
Testing
[Please provide details of testing done: unit testing, integration testing and manual testing]
Check List
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.