[8.x] [ftr] enable mock-idp-plugin for stateful (deployment-agnostic)…

… tests (elastic#192279) (elastic#193677) # Backport This will backport the following commits from `main` to `8.x`: - [[ftr] enable mock-idp-plugin for stateful (deployment-agnostic) tests (elastic#192279)](elastic#192279)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)  Co-authored-by: Dzmitry Lemechko <[email protected]>
kibanamachine · Sep 23, 2024 · dae8f17 · dae8f17
1 parent ba164e2
commit dae8f17
Show file tree

Hide file tree

Showing 3 changed files with 40 additions and 16 deletions.
diff --git a/packages/kbn-mock-idp-plugin/server/index.ts b/packages/kbn-mock-idp-plugin/server/index.ts
@@ -17,6 +17,7 @@ export const config = {
     // The plugin should only be enabled in Serverless.
     enabled: offeringBasedSchema({
       serverless: schema.boolean({ defaultValue: true }),
+      traditional: schema.boolean({ defaultValue: false }),
       options: { defaultValue: false },
     }),
   }),

diff --git a/packages/kbn-mock-idp-plugin/server/plugin.ts b/packages/kbn-mock-idp-plugin/server/plugin.ts
@@ -11,7 +11,11 @@ import type { PluginInitializer, Plugin } from '@kbn/core-plugins-server';
 import { schema } from '@kbn/config-schema';
 import type { TypeOf } from '@kbn/config-schema';
 import { MOCK_IDP_LOGIN_PATH, MOCK_IDP_LOGOUT_PATH, createSAMLResponse } from '@kbn/mock-idp-utils';
-import { SERVERLESS_ROLES_ROOT_PATH, readRolesFromResource } from '@kbn/es';
+import {
+  SERVERLESS_ROLES_ROOT_PATH,
+  STATEFUL_ROLES_ROOT_PATH,
+  readRolesFromResource,
+} from '@kbn/es';
 import { resolve } from 'path';
 import { CloudSetup } from '@kbn/cloud-plugin/server';
 
@@ -42,6 +46,11 @@ const readServerlessRoles = (projectType: string) => {
   }
 };
 
+const readStatefulRoles = () => {
+  const rolesResourcePath = resolve(STATEFUL_ROLES_ROOT_PATH, 'roles.yml');
+  return readRolesFromResource(rolesResourcePath);
+};
+
 export type CreateSAMLResponseParams = TypeOf<typeof createSAMLResponseSchema>;
 
 export const plugin: PluginInitializer<
@@ -73,22 +82,18 @@ export const plugin: PluginInitializer<
         options: { authRequired: false },
       },
       (context, request, response) => {
-        const projectType = plugins.cloud.serverless?.projectType;
-        if (!projectType) {
-          return response.customError({ statusCode: 500, body: 'projectType is not defined' });
-        } else {
-          try {
-            if (roles.length === 0) {
-              roles.push(...readServerlessRoles(projectType));
-            }
-            return response.ok({
-              body: {
-                roles,
-              },
-            });
-          } catch (err) {
-            return response.customError({ statusCode: 500, body: err.message });
+        try {
+          if (roles.length === 0) {
+            const projectType = plugins.cloud?.serverless?.projectType;
+            roles.push(...(projectType ? readServerlessRoles(projectType) : readStatefulRoles()));
           }
+          return response.ok({
+            body: {
+              roles,
+            },
+          });
+        } catch (err) {
+          return response.customError({ statusCode: 500, body: err.message });
         }
       }
     );

diff --git a/x-pack/test/api_integration/deployment_agnostic/default_configs/stateful.config.base.ts b/x-pack/test/api_integration/deployment_agnostic/default_configs/stateful.config.base.ts
@@ -43,12 +43,19 @@ export function createStatefulTestConfig<T extends DeploymentAgnosticCommonServi
       );
     }
 
+    // if config is executed on CI or locally
+    const isRunOnCI = process.env.CI;
+
     const xPackAPITestsConfig = await readConfigFile(require.resolve('../../config.ts'));
 
     // TODO: move to kbn-es because currently metadata file has hardcoded entityID and Location
     const idpPath = require.resolve(
       '@kbn/security-api-integration-helpers/saml/idp_metadata_mock_idp.xml'
     );
+    const samlIdPPlugin = path.resolve(
+      __dirname,
+      '../../../security_api_integration/plugins/saml_provider'
+    );
 
     const servers = {
       kibana: {
@@ -98,6 +105,17 @@ export function createStatefulTestConfig<T extends DeploymentAgnosticCommonServi
         ...xPackAPITestsConfig.get('kbnTestServer'),
         serverArgs: [
           ...xPackAPITestsConfig.get('kbnTestServer.serverArgs'),
+          // if the config is run locally, explicitly enable mock-idp-plugin for UI role selector
+          ...(isRunOnCI ? [] : ['--mock_idp_plugin.enabled=true']),
+          // This ensures that we register the Security SAML API endpoints.
+          // In the real world the SAML config is injected by control plane.
+          `--plugin-path=${samlIdPPlugin}`,
+          '--xpack.cloud.id=ftr_fake_cloud_id',
+          // Ensure that SAML is used as the default authentication method whenever a user navigates to Kibana. In other
+          // words, Kibana should attempt to authenticate the user using the provider with the lowest order if the Login
+          // Selector is disabled (replicating Serverless configuration). By declaring `cloud-basic` with a higher
+          // order, we indicate that basic authentication can still be used, but only if explicitly requested when the
+          // user navigates to `/login` page directly and enters username and password in the login form.
           '--xpack.security.authc.selector.enabled=false',
           `--xpack.security.authc.providers=${JSON.stringify({
             saml: { 'cloud-saml-kibana': { order: 0, realm: MOCK_IDP_REALM_NAME } },