Prepare the Security domain HTTP APIs for Serverless #162087

jeramysoucy · 2023-07-17T20:41:58Z

Summary

Uses build flavor(see #161930) to disable specific Kibana security, spaces, and encrypted saved objects HTTP API routes in serverless (see details in #161337). HTTP APIs that will be public in serverless have been handled in #162523.

IMPORTANT: This PR leaves login, user, and role routes enabled. The primary reason for this is due to several testing mechanisms that rely on basic authentication and custom roles (UI, Cypress). These tests will be modified to use SAML authentication and serverless roles in the immediate future. Once this occurs, we will disable these routes.

Testing

This PR also implements testing API access in serverless.

The testing strategy for disabled routes in serverless is to verify a 404 not found response.
The testing strategy for internal access routes in serverless is to verify that without the internal request header (x-elastic-internal-origin), a 400 bad request response is received, then verify that with the internal request header, a 200 ok response is received.
The strategy for public routes in serverless is to verify a 200 ok or 203 redirect is received.

~~blocked by #161930~~
~~blocked by #162149 for test implementation~~

x-pack/plugins/spaces/server/plugin.ts

…ernal header usage.

x-pack/plugins/spaces/server/plugin.ts

jeramysoucy · 2023-07-24T19:08:00Z

x-pack/plugins/spaces/server/plugin.ts

-      externalRouter,
+    const buildFlavor = this.initializerContext.env.packageInfo.buildFlavor;
+    const router = core.http.createRouter<SpacesRequestHandlerContext>();
+    if (buildFlavor !== 'serverless') {


I opted to make decisions as high-level as possible so we don't have to dig into each route to understand the impact of the build flavor.

++, over time, if we still use buildFlavor, we might even re-organize our routes to make it easier to toggle them (e.g. common + {non-serverless-name-tbd}-routes)

…fix'

…-ref HEAD~1..HEAD --fix'

…fix'

Removes optional authc on catch-all route.

…-ref HEAD~1..HEAD --fix'

…fix'

pheyos

LGTM

azasypkin · 2023-08-21T12:16:59Z

ACK: will review today or, at the latest, tomorrow.

azasypkin · 2023-08-21T13:06:01Z

x-pack/plugins/spaces/server/routes/api/external/index.ts

  initGetSpaceApi(deps);
  initGetAllSpacesApi(deps);
-  initPostSpacesApi(deps);
  initPutSpacesApi(deps);


note: iirc, we don't need initPutSpacesApi in Serverless for now as well.

azasypkin · 2023-08-22T09:50:35Z

x-pack/test_serverless/functional/test_suites/security/cypress/tasks/login.ts

@@ -32,7 +31,7 @@ const sendApiLoginRequest = (
    url: url.toString(),
    body: {
      providerType: 'basic',
-      providerName: isLocalhost(url.hostname) ? 'basic' : 'cloud-basic',
+      providerName: 'basic',


@jeramysoucy why do we need to make this change? I thought it was intentionally done like that to support tests in ESS?

Checked with Larry and got more context around the issue you were trying to solve here - sounds good to me. We can re-consider it in the future if we need to.

…al implementation detatail of Saml Tools.

azasypkin

LGTM, thanks! Left one question regarding Cypress tests and pushed a few small fixes in 5e953fa.

…not needed for functional tests.

kibana-ci · 2023-08-22T18:46:19Z

💚 Build Succeeded

Buildkite Build
Commit: 710ca09
Kibana Serverless Image: docker.elastic.co/kibana-ci/kibana-serverless:pr-162087-710ca09bec2f

Metrics [docs]

Canvas Sharable Runtime

The Canvas "shareable runtime" is an bundle produced to enable running Canvas workpads outside of Kibana. This bundle is included in third-party webpages that embed canvas and therefor should be as slim as possible.

id	before	after	diff
`module count`	-	5577	+5577
`total size`	-	6.1MB	+6.1MB

History

💚 Build #152437 succeeded 573a552
💔 Build #152323 failed 5e953fa
💚 Build #151407 succeeded c552a53
💔 Build #151228 failed 305aa70
💔 Build #151211 failed a979e58

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @jeramysoucy

* main: (150 commits) Fixes unnecessary autocompletes on HTTP methods (elastic#163233) [Defend Workflows] Convert filterQuery to kql (elastic#161806) [Fleet] copy `inactivity_timeout` when duplicating agent policy (elastic#164544) Fix 7.17 forward compatibility with 8.2+ (elastic#164274) [ML] Fixes dark mode in flyouts and modals (elastic#164399) [Defend Workflows]Changes to policy settings are not persistent until a refresh (elastic#164403) [Security Solution][Endpoint] Fixes kibana crash when going back to policy details page (elastic#164329) Prepare the Security domain HTTP APIs for Serverless (elastic#162087) skip failing test suite (elastic#160986) [Security Solution] Fix flaky Event Filters test (elastic#164473) [EDR workflows] Osquery serverless tests (elastic#163795) [Fleet] Only show agent dashboard links if there is more than one non-server agent and if the dashboards exist (elastic#164469) [Chrome UI] Fix background color in serverless (elastic#164419) [DOCS] Saved objects - resolve import errors API (elastic#162825) Remove 'Create Rule' button from Rule Group page (elastic#164167) [Security Solution] expandable flyout - fix infinite loop in correlations (elastic#163450) [Remote Clusters] Update copy about port help text (elastic#164442) [api-docs] 2023-08-23 Daily api_docs build (elastic#164524) [data views] Disable scripted fields in serverless environment (elastic#163228) [Reporting] Fix - show diagnostic only when image reporting is enabled (elastic#164336) ...

…#162087)" This reverts commit fe0ffab.

…lastic#162087)"" This reverts commit 35e777e.

Disables spaces public APIs in serverless

f7ba619

jeramysoucy added Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! release_note:skip Skip the PR/issue when compiling release notes v8.10.0 backport:skip This commit does not require backporting labels Jul 17, 2023

jeramysoucy commented Jul 17, 2023

View reviewed changes

x-pack/plugins/spaces/server/plugin.ts Show resolved Hide resolved

jeramysoucy added 2 commits July 17, 2023 18:01

Updates tests and snapshots

5203a0b

Fixes more tests

08146f0

jeramysoucy added the blocked label Jul 19, 2023

Merge branch 'main' into disable-spaces-public-api-in-serverless

c10abc7

jeramysoucy self-assigned this Jul 20, 2023

jeramysoucy removed the blocked label Jul 20, 2023

jeramysoucy mentioned this pull request Jul 20, 2023

Prepare the Security, Spaces, and Encrypted Saved Objects HTTP APIs for the Serverless offering #161337

Closed

34 tasks

Merge branch 'main' into disable-spaces-public-api-in-serverless

dc727cd

jeramysoucy added the blocked label Jul 20, 2023

jeramysoucy mentioned this pull request Jul 24, 2023

Marks public security, spaces, and encrypted saved object APIs #162410

Closed

jeramysoucy added 3 commits July 24, 2023 10:37

Uses build flavor to determine correct API access. Adds tests for int…

70f06f7

…ernal header usage.

Fixes unit tests for access-configurable endpoints.

8b0c93d

Merge branch 'main' into disable-spaces-public-api-in-serverless

7a346b6

jeramysoucy commented Jul 24, 2023

View reviewed changes

x-pack/plugins/spaces/server/plugin.ts Outdated Show resolved Hide resolved

Reformatting

04f1c92

jeramysoucy commented Jul 24, 2023

View reviewed changes

jeramysoucy and others added 4 commits July 25, 2023 17:02

Update to rely on default access in serverless.

6c53a54

[CI] Auto-commit changed files from 'node scripts/lint_ts_projects --…

4f20016

…fix'

Merge branch 'main' into disable-spaces-public-api-in-serverless

a44549d

Merge branch 'main' into disable-spaces-public-api-in-serverless

8f20ee0

jeramysoucy changed the title ~~Disables spaces public APIs in serverless~~ Prepare the Security domain HTTP APIs for Serverless Jul 26, 2023

jeramysoucy added 3 commits July 26, 2023 16:04

Disables security and encrypted saved objects APIs for serverless

994654c

Adds authentication API access tests

aa8c78e

Merge branch 'main' into disable-spaces-public-api-in-serverless

e4f60db

jeramysoucy and others added 6 commits August 16, 2023 18:23

Removes reference to getSAMLResponse

051cf71

[CI] Auto-commit changed files from 'node scripts/precommit_hook.js -…

4ca4924

…-ref HEAD~1..HEAD --fix'

[CI] Auto-commit changed files from 'node scripts/lint_ts_projects --…

305aa70

…fix'

Moves saml tools back into shared.

ba78385

Removes optional authc on catch-all route.

[CI] Auto-commit changed files from 'node scripts/precommit_hook.js -…

d2ee490

…-ref HEAD~1..HEAD --fix'

[CI] Auto-commit changed files from 'node scripts/lint_ts_projects --…

c552a53

…fix'

jeramysoucy added blocker and removed blocked labels Aug 17, 2023

jeramysoucy mentioned this pull request Aug 17, 2023

Disable login & user HTTP routes in Serverless #164219

Open

pheyos approved these changes Aug 21, 2023

View reviewed changes

azasypkin self-requested a review August 21, 2023 12:17

Merge branch 'main' into pr-162087-apis

084e495

azasypkin reviewed Aug 21, 2023

View reviewed changes

azasypkin added the ci:build-serverless-image label Aug 22, 2023

azasypkin reviewed Aug 22, 2023

View reviewed changes

azasypkin added 3 commits August 22, 2023 12:07

Merge branch 'main' into pr-162087-apis

d0292f8

Merge branch 'main' into pr-162087-apis

e8b0bef

Review#1: fix typos, disable Spaces Update API, make cookie an intern…

5e953fa

…al implementation detatail of Saml Tools.

azasypkin approved these changes Aug 22, 2023

View reviewed changes

azasypkin added 2 commits August 22, 2023 18:05

Review#1: move Saml Tools service to API integrations services as it …

573a552

…not needed for functional tests.

Merge branch 'main' into disable-spaces-public-api-in-serverless

710ca09

azasypkin merged commit fe0ffab into elastic:main Aug 23, 2023

kibanamachine added the v8.11.0 label Aug 23, 2023

mistic added a commit to Ikuni17/kibana that referenced this pull request Aug 24, 2023

Revert "Prepare the Security domain HTTP APIs for Serverless (elastic…

35e777e

…#162087)" This reverts commit fe0ffab.

Ikuni17 added a commit to Ikuni17/kibana that referenced this pull request Aug 25, 2023

Revert "Revert "Prepare the Security domain HTTP APIs for Serverless (e…

bc7b1ab

…lastic#162087)"" This reverts commit 35e777e.

kibanamachine mentioned this pull request Sep 7, 2023

[Discover] Unskip "search source fetch" flaky tests #165586

Merged

dmlemeshko mentioned this pull request Sep 11, 2024

[ftr] enable mock-idp-plugin for stateful (deployment-agnostic) tests #192279

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Prepare the Security domain HTTP APIs for Serverless #162087

Prepare the Security domain HTTP APIs for Serverless #162087

jeramysoucy commented Jul 17, 2023 •

edited

Loading

jeramysoucy Jul 24, 2023

azasypkin Jul 25, 2023

pheyos left a comment

azasypkin commented Aug 21, 2023

azasypkin Aug 21, 2023

azasypkin Aug 22, 2023

azasypkin Aug 23, 2023

azasypkin left a comment •

edited

Loading

kibana-ci commented Aug 22, 2023 •

edited

Loading

Prepare the Security domain HTTP APIs for Serverless #162087

Prepare the Security domain HTTP APIs for Serverless #162087

Conversation

jeramysoucy commented Jul 17, 2023 • edited Loading

Summary

Testing

jeramysoucy Jul 24, 2023

Choose a reason for hiding this comment

azasypkin Jul 25, 2023

Choose a reason for hiding this comment

pheyos left a comment

Choose a reason for hiding this comment

azasypkin commented Aug 21, 2023

azasypkin Aug 21, 2023

Choose a reason for hiding this comment

azasypkin Aug 22, 2023

Choose a reason for hiding this comment

azasypkin Aug 23, 2023

Choose a reason for hiding this comment

azasypkin left a comment • edited Loading

Choose a reason for hiding this comment

kibana-ci commented Aug 22, 2023 • edited Loading

💚 Build Succeeded

Metrics [docs]

Canvas Sharable Runtime

History

jeramysoucy commented Jul 17, 2023 •

edited

Loading

azasypkin left a comment •

edited

Loading

kibana-ci commented Aug 22, 2023 •

edited

Loading