Skip to content

Commit 6c6c44e

Browse files
jkakavasjkakavas
authored
Replace Vagrant with Docker for idp-fixture (elastic#39948)
The change replaces the Vagrant box based fixture with a fixture based on docker compose and 2 docker images, one for an openldap server and one for a Shibboleth SAML Identity Provider. The configuration of both openldap and shibboleth is identical to the previous one, in order to minimize required changes in the tests
1 parent 43065ea commit 6c6c44e

File tree

144 files changed

+5883
-1083
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

144 files changed

+5883
-1083
lines changed

‎x-pack/qa/openldap-tests/build.gradle

Lines changed: 6 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,5 @@
1-
Project idpFixtureProject = xpackProject("test:idp-fixture")
2-
evaluationDependsOn(idpFixtureProject.path)
3-
41
apply plugin: 'elasticsearch.standalone-test'
5-
apply plugin: 'elasticsearch.vagrantsupport'
2+
apply plugin: 'elasticsearch.test.fixtures'
63

74
dependencies {
85
// "org.elasticsearch.plugin:x-pack-core:${version}" doesn't work with idea because the testArtifacts are also here
@@ -11,21 +8,13 @@ dependencies {
118
testCompile project(path: xpackModule('core'), configuration: 'testArtifacts')
129
}
1310

14-
task openLdapFixture {
15-
dependsOn "vagrantCheckVersion", "virtualboxCheckVersion", idpFixtureProject.up
16-
}
11+
testFixtures.useFixture ":x-pack:test:idp-fixture"
1712

13+
Project idpFixtureProject = xpackProject("test:idp-fixture")
1814
String outputDir = "${project.buildDir}/generated-resources/${project.name}"
1915
task copyIdpTrust(type: Copy) {
20-
from idpFixtureProject.file('src/main/resources/certs/idptrust.jks');
21-
from idpFixtureProject.file('src/main/resources/certs/ca.crt');
16+
from idpFixtureProject.file('openldap/certs/ca.jks');
17+
from idpFixtureProject.file('openldap/certs/ca_server.pem');
2218
into outputDir
2319
}
24-
if (project.rootProject.vagrantSupported) {
25-
project.sourceSets.test.output.dir(outputDir, builtBy: copyIdpTrust)
26-
unitTest.dependsOn openLdapFixture
27-
unitTest.finalizedBy idpFixtureProject.halt
28-
} else {
29-
unitTest.enabled = false
30-
testingConventions.enabled = false
31-
}
20+
project.sourceSets.test.output.dir(outputDir, builtBy: copyIdpTrust)

‎x-pack/qa/openldap-tests/src/test/java/org/elasticsearch/test/OpenLdapTests.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ public class OpenLdapTests extends ESTestCase {
5656

5757
public static final String PASSWORD = "NickFuryHeartsES";
5858
private static final String HAWKEYE_DN = "uid=hawkeye,ou=people,dc=oldap,dc=test,dc=elasticsearch,dc=com";
59-
public static final String LDAPTRUST_PATH = "/idptrust.jks";
59+
public static final String LDAPTRUST_PATH = "/ca.jks";
6060
private static final SecureString PASSWORD_SECURE_STRING = new SecureString(PASSWORD.toCharArray());
6161
public static final String REALM_NAME = "oldap-test";
6262

‎x-pack/qa/openldap-tests/src/test/java/org/elasticsearch/xpack/security/authc/ldap/OpenLdapUserSearchSessionFactoryTests.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ public class OpenLdapUserSearchSessionFactoryTests extends ESTestCase {
4848

4949
private Settings globalSettings;
5050
private ThreadPool threadPool;
51-
private static final String LDAPCACERT_PATH = "/ca.crt";
51+
private static final String LDAPCACERT_PATH = "/ca_server.pem";
5252

5353
@Before
5454
public void init() {

‎x-pack/qa/openldap-tests/src/test/java/org/elasticsearch/xpack/security/authc/ldap/SearchGroupsResolverTests.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,6 @@ protected String bindPassword() {
181181

182182
@Override
183183
protected String trustPath() {
184-
return "/idptrust.jks";
184+
return "/ca.jks";
185185
}
186186
}

‎x-pack/qa/saml-idp-tests/build.gradle

Lines changed: 6 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
Project idpFixtureProject = xpackProject("test:idp-fixture")
22
evaluationDependsOn(idpFixtureProject.path)
33

4-
apply plugin: 'elasticsearch.vagrantsupport'
54
apply plugin: 'elasticsearch.standalone-rest-test'
65
apply plugin: 'elasticsearch.rest-test'
6+
apply plugin: 'elasticsearch.test.fixtures'
77

88
dependencies {
99
// "org.elasticsearch.plugin:x-pack-core:${version}" doesn't work with idea because the testArtifacts are also here
@@ -12,24 +12,16 @@ dependencies {
1212
testCompile project(path: xpackModule('security'), configuration: 'testArtifacts')
1313
testCompile 'com.google.jimfs:jimfs:1.1'
1414
}
15+
testFixtures.useFixture ":x-pack:test:idp-fixture"
1516

16-
task idpFixture {
17-
dependsOn "vagrantCheckVersion", "virtualboxCheckVersion", idpFixtureProject.up
18-
}
1917

2018
String outputDir = "${project.buildDir}/generated-resources/${project.name}"
2119
task copyIdpCertificate(type: Copy) {
22-
from idpFixtureProject.file('src/main/resources/certs/ca.crt');
20+
from idpFixtureProject.file('idp/shibboleth-idp/credentials/idp-browser.pem');
2321
into outputDir
2422
}
25-
if (project.rootProject.vagrantSupported) {
26-
project.sourceSets.test.output.dir(outputDir, builtBy: copyIdpCertificate)
27-
integTestCluster.dependsOn idpFixture, copyIdpCertificate
28-
integTest.finalizedBy idpFixtureProject.halt
29-
} else {
30-
integTest.enabled = false
31-
testingConventions.enabled = false
32-
}
23+
project.sourceSets.test.output.dir(outputDir, builtBy: copyIdpCertificate)
24+
integTestCluster.dependsOn copyIdpCertificate
3325

3426
integTestCluster {
3527
setting 'xpack.license.self_generated.type', 'trial'
@@ -60,7 +52,7 @@ integTestCluster {
6052

6153
setting 'xpack.ml.enabled', 'false'
6254

63-
extraConfigFile 'idp-metadata.xml', idpFixtureProject.file("src/main/resources/provision/generated/idp-metadata.xml")
55+
extraConfigFile 'idp-metadata.xml', idpFixtureProject.file("idp/shibboleth-idp/metadata/idp-metadata.xml")
6456

6557
setupCommand 'setupTestAdmin',
6658
'bin/elasticsearch-users', 'useradd', "test_admin", '-p', 'x-pack-test-password', '-r', "superuser"

‎x-pack/qa/saml-idp-tests/src/test/java/org/elasticsearch/xpack/security/authc/saml/SamlAuthenticationIT.java

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -367,7 +367,7 @@ private URI goToLoginPage(CloseableHttpClient client, BasicHttpContext context)
367367
private URI submitLoginForm(CloseableHttpClient client, BasicHttpContext context, URI formUri) throws IOException {
368368
final HttpPost form = new HttpPost(formUri);
369369
List<NameValuePair> params = new ArrayList<>();
370-
params.add(new BasicNameValuePair("j_username", "Thor"));
370+
params.add(new BasicNameValuePair("j_username", "thor"));
371371
params.add(new BasicNameValuePair("j_password", "NickFuryHeartsES"));
372372
params.add(new BasicNameValuePair("_eventId_proceed", ""));
373373
form.setEntity(new UrlEncodedFormEntity(params));
@@ -376,7 +376,6 @@ private URI submitLoginForm(CloseableHttpClient client, BasicHttpContext context
376376
assertThat(response.getStatusLine().getStatusCode(), equalTo(302));
377377
return response.getFirstHeader("Location").getValue();
378378
});
379-
assertThat(redirect, startsWith("/"));
380379

381380
String target = execute(client, new HttpGet(formUri.resolve(redirect)), context, response -> {
382381
assertHttpOk(response.getStatusLine());
@@ -620,7 +619,7 @@ private CloseableHttpClient getHttpClient() throws Exception {
620619
}
621620

622621
private SSLContext getClientSslContext() throws Exception {
623-
final Path pem = getDataPath("/ca.crt");
622+
final Path pem = getDataPath("/idp-browser.pem");
624623
final Certificate[] certificates = CertParsingUtils.readCertificates(Collections.singletonList(pem));
625624
final X509ExtendedTrustManager trustManager = CertParsingUtils.trustManager(certificates);
626625
SSLContext context = SSLContext.getInstance("TLS");

‎x-pack/test/idp-fixture/README.txt

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1 @@
1-
Provisions OpenLDAP + shibboleth IDP 3.3.1 .
2-
Uses ansible on the guest.
3-
4-
Run: `vagrant up --provision`
5-
6-
Any issues: [email protected]
1+
Provisions OpenLDAP + shibboleth IDP 3.4.2 using docker compose

‎x-pack/test/idp-fixture/Vagrantfile

Lines changed: 0 additions & 24 deletions
This file was deleted.

‎x-pack/test/idp-fixture/build.gradle

Lines changed: 2 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -1,42 +1,4 @@
11
apply plugin: 'elasticsearch.build'
2+
apply plugin: 'elasticsearch.test.fixtures'
23

3-
Map<String, String> vagrantEnvVars = [
4-
'VAGRANT_CWD' : "${project.projectDir.absolutePath}",
5-
'VAGRANT_VAGRANTFILE' : 'Vagrantfile',
6-
'VAGRANT_PROJECT_DIR' : "${project.projectDir.absolutePath}"
7-
]
8-
9-
String box = "test.shibboleth.elastic.local"
10-
11-
task update(type: org.elasticsearch.gradle.vagrant.VagrantCommandTask) {
12-
command 'box'
13-
subcommand 'update'
14-
boxName box
15-
environmentVars vagrantEnvVars
16-
}
17-
18-
task up(type: org.elasticsearch.gradle.vagrant.VagrantCommandTask) {
19-
command 'up'
20-
args '--provision', '--provider', 'virtualbox'
21-
boxName box
22-
environmentVars vagrantEnvVars
23-
dependsOn update
24-
}
25-
26-
task halt(type: org.elasticsearch.gradle.vagrant.VagrantCommandTask) {
27-
command 'halt'
28-
boxName box
29-
environmentVars vagrantEnvVars
30-
}
31-
32-
task destroy(type: org.elasticsearch.gradle.vagrant.VagrantCommandTask) {
33-
command 'destroy'
34-
args '-f'
35-
boxName box
36-
environmentVars vagrantEnvVars
37-
dependsOn halt
38-
}
39-
40-
thirdPartyAudit.enabled = false
41-
unitTest.enabled = false
42-
jarHell.enabled = false
4+
unitTest.enabled = false

‎x-pack/test/idp-fixture/docker-compose.yml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
version: '3.1'
2+
services:
3+
openldap:
4+
command: --copy-service --loglevel debug
5+
image: "osixia/openldap:1.2.3"
6+
ports:
7+
- "30389:389"
8+
- "60636:636"
9+
environment:
10+
LDAP_ADMIN_PASSWORD: "NickFuryHeartsES"
11+
LDAP_DOMAIN: "oldap.test.elasticsearch.com"
12+
LDAP_BASE_DN: "DC=oldap,DC=test,DC=elasticsearch,DC=com"
13+
LDAP_TLS: "true"
14+
LDAP_TLS_CRT_FILENAME: "ldap_server.pem"
15+
LDAP_TLS_CA_CRT_FILENAME: "ca_server.pem"
16+
LDAP_TLS_KEY_FILENAME: "ldap_server.key"
17+
LDAP_TLS_VERIFY_CLIENT: "never"
18+
LDAP_TLS_CIPHER_SUITE: "NORMAL"
19+
LDAP_LOG_LEVEL: 256
20+
volumes:
21+
- ./openldap/ldif/users.ldif:/container/service/slapd/assets/config/bootstrap/ldif/custom/20-bootstrap-users.ldif
22+
- ./openldap/ldif/config.ldif:/container/service/slapd/assets/config/bootstrap/ldif/custom/10-bootstrap-config.ldif
23+
- ./openldap/certs:/container/service/slapd/assets/certs
24+
25+
shibboleth-idp:
26+
image: "unicon/shibboleth-idp:3.4.2"
27+
depends_on:
28+
- openldap
29+
environment:
30+
- JETTY_MAX_HEAP=64m
31+
- JETTY_BROWSER_SSL_KEYSTORE_PASSWORD=secret
32+
- JETTY_BACKCHANNEL_SSL_KEYSTORE_PASSWORD=secret
33+
ports:
34+
- "4443:4443"
35+
links:
36+
- openldap:openldap
37+
volumes:
38+
- ./idp/shibboleth-idp/conf:/opt/shibboleth-idp/conf
39+
- ./idp/shibboleth-idp/credentials:/opt/shibboleth-idp/credentials
40+
- ./idp/shib-jetty-base/start.d/ssl.ini:/opt/shib-jetty-base/start.d/ssl.ini

‎x-pack/test/idp-fixture/idp/shib-jetty-base/start.d/ssl.ini

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
--module=ssl
2+
jetty.ssl.port=4443
3+
jetty.sslContext.keyStorePath=/opt/shibboleth-idp/credentials/idp-browser.p12
4+
jetty.sslContext.keyStoreType=PKCS12

‎x-pack/test/idp-fixture/idp/shibboleth-idp/conf/access-control.xml

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<beans xmlns="http://www.springframework.org/schema/beans"
3+
xmlns:context="http://www.springframework.org/schema/context"
4+
xmlns:util="http://www.springframework.org/schema/util"
5+
xmlns:p="http://www.springframework.org/schema/p"
6+
xmlns:c="http://www.springframework.org/schema/c"
7+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
8+
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
9+
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
10+
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
11+
12+
default-init-method="initialize"
13+
default-destroy-method="destroy">
14+
15+
<!--
16+
Map of access control policies used to limit access to administrative functions.
17+
The purpose of the map is to label policies with a key/name so they can be reused.
18+
-->
19+
20+
<!--
21+
Use the "shibboleth.IPRangeAccessControl" parent bean for IP-based access control.
22+
The ranges provided MUST be CIDR network expressions. To specify a single address,
23+
add "/32" or "/128" for IPv4 or IPv6 respectively.
24+
25+
The additional examples below demonstrate how to control access by username
26+
and by attribute(s), in the case of authenticated access to admin functions.
27+
-->
28+
29+
<util:map id="shibboleth.AccessControlPolicies">
30+
31+
<entry key="AccessByIPAddress">
32+
<bean id="AccessByIPAddress" parent="shibboleth.IPRangeAccessControl"
33+
p:allowedRanges="#{ {'127.0.0.1/32', '::1/128'} }" />
34+
</entry>
35+
36+
<!--
37+
<entry key="AccessByUser">
38+
<bean parent="shibboleth.PredicateAccessControl">
39+
<constructor-arg>
40+
<bean parent="shibboleth.Conditions.SubjectName" c:collection="#{'jdoe'}" />
41+
</constructor-arg>
42+
</bean>
43+
</entry>
44+
-->
45+
46+
<!--
47+
<entry key="AccessByAttribute">
48+
<bean parent="shibboleth.PredicateAccessControl">
49+
<constructor-arg>
50+
<bean class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate">
51+
<property name="attributeValueMap">
52+
<map>
53+
<entry key="eduPersonEntitlement">
54+
<list>
55+
<value>https://example.org/entitlement/idpadmin</value>
56+
</list>
57+
</entry>
58+
</map>
59+
</property>
60+
</bean>
61+
</constructor-arg>
62+
</bean>
63+
</entry>
64+
-->
65+
66+
</util:map>
67+
68+
</beans>

0 commit comments

Comments
 (0)