[TEST] Precache LDAP authentication #84748
Conversation
GroupMappingIT would somtimes due to a timeout when authenticating against the SMB fixture. This changes the test to first perform an "authenticate" request, with retries in order to cache the user's credentials before performing the access checks. This means that the access checks should pass/fail due to true authorization behaviour rather than authentication behaviour. Resolves: elastic#84586
tvernum
added
>test
|
Pinging @elastic/es-security (Team:Security) |
|
Ping @albertzaharovits |
| final Client client = client().filterWithHeader(Collections.singletonMap(BASIC_AUTH_HEADER, userHeader(user, PASSWORD))); | ||
| // Force an authentication to populate the cache. | ||
| // We can safely re-try this if it fails, which means we can be more confident that the index request failed for the correct reason | ||
| authenticateUser(client, user, 3); |
There was a problem hiding this comment.
What do you say if we move this bits in a method like assertAdFixtureIsActive (maybe followed by a realm cache call) and call that in a @Before method.
I think this would scoped tighter to the lazy fixture problem. Scatering authenticate calls before every index runs the slight potential to hide true issues (and it makes test console dumps harder to follow).
There was a problem hiding this comment.
The tricky bit is that we need to do it for each user - the problem is that we need every user to be in the cache so we avoid external LDAP calls during authz checks
That could be done, but it's not just one user - it's several and we'd need to pre-cache each of them.
I'm not sure that ends up being a nicer solution.
albertzaharovits
left a comment
albertzaharovits
left a comment
There was a problem hiding this comment.
I would repeat the authn to probe the fixture only once per test suite, but I'm OK either way.
Sorry for defering the review of this.
LGTM
|
I'm going to merge as-is. I like the idea of moving this out of the assertion method, but I don't see a nice way to do that, and I'm keen to get the test fixed. Happy to revisit if there are suggestions. |
4 participants
GroupMappingIT would somtimes due to a timeout when authenticating
against the SMB fixture.
This changes the test to first perform an "authenticate" request,
with retries in order to cache the user's credentials before
performing the access checks.
This means that the access checks should pass/fail due to true
authorization behaviour rather than authentication behaviour.
Resolves: #84586, #83144