Skip to content

add MS Graph third party tests to periodic tests job #130380

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

Conversation

richard-dennehy
Copy link
Contributor

@richard-dennehy richard-dennehy commented Jul 1, 2025

Add periodic tests for the new Entra ID/Microsoft Graph Authz plugin that use real credentials in the azure2 test account. This will give us advance notice if Microsoft make any breaking changes to the APIs we're using.

@richard-dennehy richard-dennehy requested a review from a team as a code owner July 1, 2025 08:29
@richard-dennehy richard-dennehy added >test Issues or PRs that are addressing/adding tests :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) Team:Security Meta label for security team auto-backport Automatically create backport pull requests when merged v9.2.0 v9.1.1 v8.19.1 labels Jul 1, 2025
@elasticsearchmachine
Copy link
Collaborator

Pinging @elastic/es-security (Team:Security)

Comment on lines 11 to 25
boolean useFixture = false
String msGraphTenantId = System.getenv("ms_graph_tenant_id")
String msGraphClientId = System.getenv("ms_graph_client_id")
String msGraphClientSecret = System.getenv("ms_graph_client_secret")
String msGraphUsername = System.getenv("ms_graph_username")
String msGraphGroupId = System.getenv("ms_graph_groupid")

if (!msGraphTenantId || !msGraphClientId || !msGraphClientSecret || !msGraphUsername || !msGraphGroupId) {
msGraphTenantId = "tenant-id"
msGraphClientId = "client_id"
msGraphClientSecret = "client_secret"
msGraphUsername = "Thor"
msGraphGroupId = "test_group"
useFixture = true
}
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

using a similar pattern to other third party tests

boolean useFixture = false
String azureAccount = System.getenv("azure_storage_account")
String azureKey = System.getenv("azure_storage_key")
String azureContainer = System.getenv("azure_storage_container")
String azureBasePath = System.getenv("azure_storage_base_path")
String azureSasToken = System.getenv("azure_storage_sas_token")
String azureTenantId = System.getenv("azure_storage_tenant_id")
String azureClientId = System.getenv("azure_storage_client_id")
if (!azureAccount && !azureKey && !azureContainer && !azureBasePath && !azureSasToken) {
azureAccount = 'azure_integration_test_account'
azureKey = 'YXp1cmVfaW50ZWdyYXRpb25fdGVzdF9rZXk=' // The key is "azure_integration_test_key" encoded using base64
azureContainer = 'container'
azureBasePath = ''
azureSasToken = ''
azureTenantId = ''
azureClientId = ''
useFixture = true
}

Comment on lines +131 to +134
"xpack.security.authc.realms.microsoft_graph.microsoft_graph1.graph_host",
() -> graphFixture.getBaseUrl() + "/v1.0"
)
.setting("xpack.security.authc.realms.microsoft_graph.microsoft_graph1.access_token_host", graphFixture::getBaseUrl)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

these settings have the correct default values, so the third party test shouldn't override them

@slobodanadamovic slobodanadamovic self-requested a review July 1, 2025 11:17
Copy link
Contributor

@slobodanadamovic slobodanadamovic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

@richard-dennehy richard-dennehy merged commit e7975ab into elastic:main Jul 7, 2025
40 checks passed
richard-dennehy added a commit to richard-dennehy/elasticsearch that referenced this pull request Jul 7, 2025
@elasticsearchmachine
Copy link
Collaborator

💔 Backport failed

Status Branch Result
9.1
8.19 Commit could not be cherrypicked due to conflicts

You can use sqren/backport to manually backport by running backport --upstream elastic/elasticsearch --pr 130380

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
auto-backport Automatically create backport pull requests when merged backport pending :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) Team:Security Meta label for security team >test Issues or PRs that are addressing/adding tests v8.19.1 v9.1.1 v9.2.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants