Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

LdapSessionFactoryTests#testSslTrustIsReloaded failures #68995

Closed
jkakavas opened this issue Feb 15, 2021 · 6 comments
Closed

LdapSessionFactoryTests#testSslTrustIsReloaded failures #68995

jkakavas opened this issue Feb 15, 2021 · 6 comments
Assignees
Labels
:Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) Team:Security Meta label for security team >test-failure Triaged test failures from CI

Comments

@jkakavas
Copy link
Member

This fails in 7.x, 7.11, 6.8

Build scan:

https://gradle-enterprise.elastic.co/s/fdaeh2nciqjwg/console-log?task=:x-pack:plugin:security:unitTest
https://elasticsearch-ci.elastic.co/job/elastic+elasticsearch+pull-request-2/695/testReport/junit/org.elasticsearch.xpack.security.authc.ldap/LdapSessionFactoryTests/testSslTrustIsReloaded/

Repro line:

./gradlew ':x-pack:plugin:security:test' --tests "org.elasticsearch.xpack.security.authc.ldap.LdapSessionFactoryTests.testSslTrustIsReloaded" -Dtests.seed=39B8874359AE7DD3 -Dtests.security.manager=true -Dtests.locale=de-AT -Dtests.timezone=Canada/Pacific -Druntime.java=8

Reproduces locally?:
No
Applicable branches:
7.x, 7.11, 6.8
Failure history:
It started failing upon attempting to backport #68985
Failure excerpt:
Expected exception is not thrown.

junit.framework.AssertionFailedError: Expected exception UncategorizedExecutionException but no exception was thrown
@jkakavas jkakavas added >test-failure Triaged test failures from CI :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) labels Feb 15, 2021
@jkakavas jkakavas self-assigned this Feb 15, 2021
@elasticmachine elasticmachine added the Team:Security Meta label for security team label Feb 15, 2021
@elasticmachine
Copy link
Collaborator

Pinging @elastic/es-security (Team:Security)

albertzaharovits added a commit that referenced this issue Feb 16, 2021
LdapSessionFactoryTests#testSslTrustIsReloaded relies on the resource watcher
to detect the cert file overwriting. Resource watcher detects changes by only
inspecting the file size on disk and the last access timestamp.
For the last access timestamp, the resolution can be as low as one second depending
on the JDK and the FS type. It is thus preferable to rely on file size differences in tests.

Closes #68995
albertzaharovits added a commit to albertzaharovits/elasticsearch that referenced this issue Feb 16, 2021
LdapSessionFactoryTests#testSslTrustIsReloaded relies on the resource watcher
to detect the cert file overwriting. Resource watcher detects changes by only
inspecting the file size on disk and the last access timestamp.
For the last access timestamp, the resolution can be as low as one second depending
on the JDK and the FS type. It is thus preferable to rely on file size differences in tests.

Closes elastic#68995
albertzaharovits added a commit to albertzaharovits/elasticsearch that referenced this issue Feb 16, 2021
LdapSessionFactoryTests#testSslTrustIsReloaded relies on the resource watcher
to detect the cert file overwriting. Resource watcher detects changes by only
inspecting the file size on disk and the last access timestamp.
For the last access timestamp, the resolution can be as low as one second depending
on the JDK and the FS type. It is thus preferable to rely on file size differences in tests.

Closes elastic#68995
albertzaharovits added a commit that referenced this issue Feb 16, 2021
LdapSessionFactoryTests#testSslTrustIsReloaded relies on the resource watcher
to detect the cert file overwriting. Resource watcher detects changes by only
inspecting the file size on disk and the last access timestamp.
For the last access timestamp, the resolution can be as low as one second depending
on the JDK and the FS type. It is thus preferable to rely on file size differences in tests.

Closes #68995
albertzaharovits added a commit that referenced this issue Feb 16, 2021
LdapSessionFactoryTests#testSslTrustIsReloaded relies on the resource watcher
to detect the cert file overwriting. Resource watcher detects changes by only
inspecting the file size on disk and the last access timestamp.
For the last access timestamp, the resolution can be as low as one second depending
on the JDK and the FS type. It is thus preferable to rely on file size differences in tests.

Closes #68995
@mark-vieira
Copy link
Contributor

@ywangd
Copy link
Member

ywangd commented May 10, 2021

This is still failing on the 6.8 branch.

https://gradle-enterprise.elastic.co/s/5ar3y7afb2o2s/console-log?task=:x-pack:plugin:security:unitTest

These are different failures fall into two categories.

The first is due to TLS 1.0 and 1.1 gets disabled in latest JDK releases, which is the same issue as #72877. I muted the fail tests.

  • org.elasticsearch.xpack.security.authc.ldap.LdapSessionFactoryTests.testDeprecationWarningIfTls1IsUsed
  • org.elasticsearch.xpack.security.transport.ssl.SslIntegrationTests.testDeprecationWarningWhenHttpClientConnectsWithTLS1
  • org.elasticsearch.xpack.security.transport.ssl.SslIntegrationTests.testServerLogsDeprecationWarningWhenTransportClientConnectsWithTLS1

The second is the same as #72359. Albert muted a few with #72529 (different tests but same error message), but apparently there are more.

  • org.elasticsearch.xpack.security.FIPS140SecureSettingsBootstrapCheckTests.testLegacySecureSettingsIsNotAllowed
  • org.elasticsearch.xpack.security.authc.saml.SamlMetadataCommandTests.testDefaultOptionsWithSigningAndMultipleEncryptionKeys
  • org.elasticsearch.xpack.security.authc.saml.SamlRealmTests.testCreateEncryptionCredentialFromKeyStore
  • org.elasticsearch.xpack.security.authc.saml.SamlRealmTests.testCreateSigningCredentialFromKeyStoreSuccessScenarios
  • org.elasticsearch.xpack.security.authc.saml.SamlRealmTests.testReadIdpMetadataFromHttps
  • org.elasticsearch.xpack.security.authc.saml.SamlRealmTests.testCreateSigningCredentialFromKeyStoreFailureScenarios

But somehow they do not fail for 7.x. Did we apply some gradle magic for 7.x branches? @mark-vieira

@mark-vieira
Copy link
Contributor

But somehow they do not fail for 7.x. Did we apply some gradle magic for 7.x branches? @mark-vieira

I don't believe so. It's possible some 6.8 specific configuration go lost here but I'm not sure what it would be. Is there extra configuration that should have been around for the older branches to get these tests to pass? Or were we just not running them at all?

@williamrandolph
Copy link
Contributor

The failing 6.8 SamlRealmTests were muted here: #73314

I ran into the others related to #72359 today, so I'm going to go ahead and mute them. Do we need a new issue that covers this wider breadth of tests?

@jkakavas
Copy link
Member Author

The remaining of the failures are 6.8 specific only and this has been muted in 6.8. I'm going to close this as won't fix since 6.8 is EOL

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
:Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) Team:Security Meta label for security team >test-failure Triaged test failures from CI
Projects
None yet
Development

No branches or pull requests

5 participants