[Security Solution][Endpoint] Adds new integration tests for Endpoint Artifacts API RBAC #143273

dasansol92 · 2022-10-13T11:03:29Z

Summary

Add new test cases checking RBAC privileges for all artifacts integration tests

For maintainers

This was checked for breaking API changes and was labeled appropriately

…ration_tests-4921

… using new test roles

elasticmachine · 2022-12-21T14:12:54Z

Pinging @elastic/security-onboarding-and-lifecycle-mgt (Team:Onboarding and Lifecycle Mgt)

dasansol92 · 2022-12-21T14:22:24Z

@elasticmachine merge upstream

…ration_tests-4921

paul-tavares

Looks good. Thank you.

I did notice something that did not appear right to me - some tests are checking for a expect(400) error. 400 errors are normally due to user input, and I would not have expected any of these tests to return a 400. Do you know why that is?

dasansol92 · 2022-12-21T14:57:59Z

I did notice something that did not appear right to me - some tests are checking for a expect(400) error. 400 errors are normally due to user input, and I would not have expected any of these tests to return a 400. Do you know why that is?

@paul-tavares Yes, I think all expect(400) are related to user input:

no values
invalid OS for signer field
more than one OS
invalid hash
etc.

Does that makes sense to you?

paul-tavares · 2022-12-21T14:59:29Z

@dasansol92 ,

Ok... Cool. thanks for that and yes, that makes sense. Did not realize we were doing schema type of validation from FTR.

👍

kibana-ci · 2022-12-21T17:06:57Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 8d4365d

Failed CI Steps

Security Solution Tests #2

Test Failures

[job] [logs] Security Solution Tests #2 / Import rules Imports a custom rule with exceptions

Metrics [docs]

Unknown metric groups

ESLint disabled in files

id	before	after	diff
`osquery`	1	2	+1

ESLint disabled line counts

id	before	after	diff
`enterpriseSearch`	19	21	+2
`fleet`	61	67	+6
`osquery`	109	115	+6
`securitySolution`	439	445	+6
total			+20

Total ESLint disabled count

id	before	after	diff
`enterpriseSearch`	20	22	+2
`fleet`	70	76	+6
`osquery`	110	117	+7
`securitySolution`	515	521	+6
total			+21

History

💚 Build #96263 succeeded 3f257d6
💔 Build #80078 failed f80e198

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

ashokaditya

Thanks for all the detailed tests 🔥 I have a minor suggestion but this is good to 🚢

ashokaditya · 2022-12-22T11:38:25Z

...test/security_solution_endpoint_api_int/apis/endpoint_artifacts/host_isolation_exceptions.ts

+      'item_id' | 'namespace_type' | 'os_types' | 'tags' | 'entries'
+    >;
+    type HostIsolationExceptionApiCallsInterface<BodyGetter = UnknownBodyGetter> = Array<{
+      method: keyof Pick<typeof supertest, 'post' | 'put' | 'get' | 'delete' | 'patch'>;


Don't have to change but you could use RouteMethod here instead that is imported as

import type { RouteMethod } from '@kbn/core-http-server';

ashokaditya · 2022-12-22T11:43:47Z

x-pack/test/security_solution_endpoint_api_int/apis/endpoint_artifacts/blocklists.ts

      describe('and has authorization to manage endpoint security', () => {
        for (const blocklistApiCall of blocklistApiCalls) {
          it(`should error on [${blocklistApiCall.method}] if invalid condition entry fields are used`, async () => {
            const body = blocklistApiCall.getBody();

            body.entries[0].field = 'some.invalid.field';
-            await supertest[blocklistApiCall.method](blocklistApiCall.path)
+            await supertestWithoutAuth[blocklistApiCall.method](blocklistApiCall.path)
+              .auth(ROLE.analyst_hunter, 'changeme')


Consider updating this role to have a username and the default password so you don't have to duplicate the default password in every test. So it can be used as:

.auth(ROLE.analyst_hunter.username, ROLE.analyst_hunter.password)

Interesting, we can work on this on a subsequent pr! Thanks for the suggestion!

The fleet side does something similar as I learned recently.

… Artifacts API RBAC (elastic#143273) ## Summary - Add new test cases checking RBAC privileges for all artifacts integration tests ### For maintainers - [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) Co-authored-by: Kibana Machine <[email protected]>

Adds new integration tests for Trusted Apps API RBAC

f80e198

dasansol92 added release_note:skip Skip the PR/issue when compiling release notes backport:skip This commit does not require backporting Team:Defend Workflows “EDR Workflows” sub-team of Security Solution 8.6 candidate labels Oct 13, 2022

This was referenced Oct 26, 2022

[Security Solution][Endpoint] Adds RBAC API checks for event filters #144009

Merged

[Security Solution][Endpoint] Adds RBAC API checks for host isolation exceptions #144021

Merged

[Security Solution][Endpoint] Adds RBAC API checks for Blocklist #144047

Merged

dasansol92 added v8.7.0 and removed 8.6 candidate labels Dec 14, 2022

dasansol92 added 5 commits December 19, 2022 11:13

Merge branch 'main' into feat/olm-API_trusted_applications_RBAC_integ…

63dacf1

…ration_tests-4921

Updates roles with new privileges

7fdad39

Fixes wrong config assignment when creating test role

8d82fcf

Enables endpoint RBAC FF for integration tests

e9dde0f

Adds more RBAC test cases on existing integration tests for artifacts…

3f257d6

… using new test roles

dasansol92 changed the title ~~[Security Solution][Endpoint] Adds new integration tests for Trusted Apps API RBAC~~ [Security Solution][Endpoint] Adds new integration tests for Endpoint Artifacts API RBAC Dec 21, 2022

dasansol92 marked this pull request as ready for review December 21, 2022 14:12

dasansol92 requested review from a team as code owners December 21, 2022 14:12

dasansol92 requested review from pzl and paul-tavares December 21, 2022 14:12

Merge branch 'main' into feat/olm-API_trusted_applications_RBAC_integ…

8d4365d

…ration_tests-4921

paul-tavares approved these changes Dec 21, 2022

View reviewed changes

ashokaditya approved these changes Dec 22, 2022

View reviewed changes

dasansol92 merged commit 8d7f570 into elastic:main Dec 22, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][Endpoint] Adds new integration tests for Endpoint Artifacts API RBAC #143273

[Security Solution][Endpoint] Adds new integration tests for Endpoint Artifacts API RBAC #143273

dasansol92 commented Oct 13, 2022 •

edited

Loading

elasticmachine commented Dec 21, 2022

dasansol92 commented Dec 21, 2022

paul-tavares left a comment

dasansol92 commented Dec 21, 2022

paul-tavares commented Dec 21, 2022

kibana-ci commented Dec 21, 2022

ESLint disabled in files

ESLint disabled line counts

Total ESLint disabled count

ashokaditya left a comment

ashokaditya Dec 22, 2022

ashokaditya Dec 22, 2022

dasansol92 Dec 22, 2022

ashokaditya Dec 22, 2022 •

edited

Loading

[Security Solution][Endpoint] Adds new integration tests for Endpoint Artifacts API RBAC #143273

[Security Solution][Endpoint] Adds new integration tests for Endpoint Artifacts API RBAC #143273

Conversation

dasansol92 commented Oct 13, 2022 • edited Loading

Summary

For maintainers

elasticmachine commented Dec 21, 2022

dasansol92 commented Dec 21, 2022

paul-tavares left a comment

Choose a reason for hiding this comment

dasansol92 commented Dec 21, 2022

paul-tavares commented Dec 21, 2022

kibana-ci commented Dec 21, 2022

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

ESLint disabled in files

ESLint disabled line counts

Total ESLint disabled count

History

ashokaditya left a comment

Choose a reason for hiding this comment

ashokaditya Dec 22, 2022

Choose a reason for hiding this comment

ashokaditya Dec 22, 2022

Choose a reason for hiding this comment

dasansol92 Dec 22, 2022

Choose a reason for hiding this comment

ashokaditya Dec 22, 2022 • edited Loading

Choose a reason for hiding this comment

dasansol92 commented Oct 13, 2022 •

edited

Loading

ashokaditya Dec 22, 2022 •

edited

Loading