Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Ensure intended key is selected in SamlAuthenticatorTests #30993

Merged
merged 3 commits into from
May 31, 2018
Merged

Ensure intended key is selected in SamlAuthenticatorTests #30993

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
95826f0
Ensure that a purposefully wrong key is used
jkakavas May 31, 2018
8db000c
Ensure that the purposefully wrong key is not used in other tests
jkakavas May 31, 2018
ff2aabd
Merge remote-tracking branch 'origin/master' into fix-flaky-saml-tests
jkakavas May 31, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions ...ity/src/test/java/org/elasticsearch/xpack/security/authc/saml/SamlAuthenticatorTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -374,7 +374,7 @@ public void testFailWhenAssertionsCannotBeDecrypted() throws Exception {
final String xml = getSimpleResponse(now);

// Encrypting with different cert instead of sp cert will mean that the SP cannot decrypt
final String encrypted = encryptAssertions(xml, readKeyPair("RSA_1024"));
final String encrypted = encryptAssertions(xml, readKeyPair("RSA_4096_updated"));
assertThat(encrypted, not(equalTo(xml)));

final String signed = signDoc(encrypted);
Expand Down Expand Up @@ -896,7 +896,6 @@ public void testIdpInitiatedLoginIsAllowed() throws Exception {
assertThat(attributes.attributes(), iterableWithSize(1));
}

@AwaitsFix(bugUrl = "https://github.com/elastic/elasticsearch/issues/30970")
public void testIncorrectSigningKeyIsRejected() throws Exception {
final CryptoTransform signer = randomBoolean() ? this::signDoc : this::signAssertions;
Instant now = clock.instant();
Expand Down Expand Up @@ -938,7 +937,7 @@ public void testIncorrectSigningKeyIsRejected() throws Exception {
assertThat(authenticator.authenticate(token(signer.transform(xml, idpSigningCertificatePair))), notNullValue());

// check is rejected when signed by a different key-pair
final Tuple<X509Certificate, PrivateKey> wrongKey = readRandomKeyPair(randomSigningAlgorithm());
final Tuple<X509Certificate, PrivateKey> wrongKey = readKeyPair("RSA_4096_updated");
final ElasticsearchSecurityException exception = expectThrows(ElasticsearchSecurityException.class,
() -> authenticator.authenticate(token(signer.transform(xml, wrongKey))));
assertThat(exception.getMessage(), containsString("SAML Signature"));
Expand All @@ -954,10 +953,12 @@ public void testSigningKeyIsReloadedForEachRequest() throws Exception {
assertThat(authenticator.authenticate(token(signer.transform(xml, idpSigningCertificatePair))), notNullValue());

final Tuple<X509Certificate, PrivateKey> oldKeyPair = idpSigningCertificatePair;
//Ensure we won't read any of the ones we could have picked randomly before
// Ensure we won't read any of the ones we could have picked randomly before
idpSigningCertificatePair = readKeyPair("RSA_4096_updated");
assertThat(idpSigningCertificatePair.v2(), not(equalTo(oldKeyPair.v2())));
assertThat(authenticator.authenticate(token(signer.transform(xml, idpSigningCertificatePair))), notNullValue());
// Restore the keypair to one from the keypair pool of all algorithms and keys
idpSigningCertificatePair = readRandomKeyPair(randomSigningAlgorithm());
}

public void testParsingRejectsTamperedContent() throws Exception {
Expand Down
2 changes: 1 addition & 1 deletion ...ugin/security/src/test/java/org/elasticsearch/xpack/security/authc/saml/SamlTestCase.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ protected static Tuple<X509Certificate, PrivateKey> readRandomKeyPair() throws E
}

/**
* Generates key pair for given algorithm and then associates with a certificate.
* Reads a key pair and associated certificate for given algorithm and key length
* For testing, for "EC" algorithm 256 key size is used, others use 2048 as default.
* @param algorithm
* @return X509Certificate a signed certificate, it's PrivateKey {@link Tuple}
Expand Down