move saml-provider-plugin to packages

.github/CODEOWNERS

@@ -743,7 +743,7 @@ packages/kbn-rule-data-utils @elastic/security-detections-response @elastic/resp
 x-pack/plugins/rule_registry @elastic/response-ops @elastic/obs-ux-management-team
 x-pack/plugins/runtime_fields @elastic/kibana-management
 packages/kbn-safer-lodash-set @elastic/kibana-security
-x-pack/test/security_api_integration/plugins/saml_provider @elastic/kibana-security
+packages/kbn-saml-provider-plugin @elastic/kibana-security
 x-pack/test/plugin_api_integration/plugins/sample_task_plugin @elastic/response-ops
 x-pack/test/task_manager_claimer_update_by_query/plugins/sample_task_plugin_mget @elastic/response-ops
 test/plugin_functional/plugins/saved_object_export_transforms @elastic/kibana-core

package.json

@@ -761,7 +761,7 @@
     "@kbn/rule-registry-plugin": "link:x-pack/plugins/rule_registry",
     "@kbn/runtime-fields-plugin": "link:x-pack/plugins/runtime_fields",
     "@kbn/safer-lodash-set": "link:packages/kbn-safer-lodash-set",
-    "@kbn/saml-provider-plugin": "link:x-pack/test/security_api_integration/plugins/saml_provider",
+    "@kbn/saml-provider-plugin": "link:packages/kbn-saml-provider-plugin",
     "@kbn/sample-task-plugin": "link:x-pack/test/plugin_api_integration/plugins/sample_task_plugin",
     "@kbn/sample-task-plugin-update-by-query": "link:x-pack/test/task_manager_claimer_update_by_query/plugins/sample_task_plugin_mget",
     "@kbn/saved-object-export-transforms-plugin": "link:test/plugin_functional/plugins/saved_object_export_transforms",

packages/kbn-saml-provider-plugin/README.md

@@ -0,0 +1,3 @@
+# @kbn/saml-provider-plugin
+
+Saml provider plugin for testing purpose

x-pack/test/security_api_integration/packages/helpers/saml/saml_tools.ts → packages/kbn-saml-provider-plugin/helpers/saml_tools.ts

@@ -1,8 +1,10 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
  */
 
 import crypto from 'crypto';

packages/kbn-saml-provider-plugin/index.ts

@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import path from 'path';
+
+const resourcesPath = path.resolve(__dirname, 'resources');
+
+export const pluginPath = path.resolve(__dirname);
+
+export const IDP_METADATA_PATHS = {
+  default: path.resolve(pluginPath, 'metadata.xml'),
+  saml1: path.resolve(resourcesPath, 'idp_metadata.xml'),
+  saml2: path.resolve(resourcesPath, 'idp_metadata_2.xml'),
+  neverLogin: path.resolve(resourcesPath, 'idp_metadata_never_login.xml'),
+  mockIdpPlugin: path.resolve(resourcesPath, 'idp_metadata_mock_idp.xml'),
+};
+
+export { getLogoutRequest, getSAMLRequestId, getSAMLResponse } from './helpers/saml_tools';

packages/kbn-saml-provider-plugin/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "@kbn/saml-provider-plugin",
+  "private": true,
+  "version": "1.0.0",
+  "license": "Elastic License 2.0 OR AGPL-3.0-only OR SSPL-1.0"
+}

x-pack/test/security_api_integration/plugins/saml_provider/server/index.ts → packages/kbn-saml-provider-plugin/server/index.ts

@@ -1,8 +1,10 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
  */
 
 import type { CloudSetup } from '@kbn/cloud-plugin/server';

x-pack/test/security_api_integration/plugins/saml_provider/server/init_routes.ts → packages/kbn-saml-provider-plugin/server/init_routes.ts

@@ -1,15 +1,14 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
  */
 
 import type { CoreSetup, PluginInitializerContext } from '@kbn/core/server';
-import {
-  getSAMLRequestId,
-  getSAMLResponse,
-} from '@kbn/security-api-integration-helpers/saml/saml_tools';
+import { getSAMLRequestId, getSAMLResponse } from '../helpers/saml_tools';
 
 import type { PluginSetupDependencies } from '.';
 

packages/kbn-saml-provider-plugin/tsconfig.json

@@ -0,0 +1,21 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "target/types",
+    "types": [
+      "jest",
+      "node"
+    ]
+  },
+  "include": [
+    "**/*.ts",
+  ],
+  "exclude": [
+    "target/**/*"
+  ],
+  "kbn_references": [
+    "@kbn/dev-utils",
+    "@kbn/cloud-plugin",
+    "@kbn/core",
+  ]
+}

tsconfig.base.json

@@ -1480,8 +1480,8 @@
       "@kbn/runtime-fields-plugin/*": ["x-pack/plugins/runtime_fields/*"],
       "@kbn/safer-lodash-set": ["packages/kbn-safer-lodash-set"],
       "@kbn/safer-lodash-set/*": ["packages/kbn-safer-lodash-set/*"],
-      "@kbn/saml-provider-plugin": ["x-pack/test/security_api_integration/plugins/saml_provider"],
-      "@kbn/saml-provider-plugin/*": ["x-pack/test/security_api_integration/plugins/saml_provider/*"],
+      "@kbn/saml-provider-plugin": ["packages/kbn-saml-provider-plugin"],
+      "@kbn/saml-provider-plugin/*": ["packages/kbn-saml-provider-plugin/*"],
       "@kbn/sample-task-plugin": ["x-pack/test/plugin_api_integration/plugins/sample_task_plugin"],
       "@kbn/sample-task-plugin/*": ["x-pack/test/plugin_api_integration/plugins/sample_task_plugin/*"],
       "@kbn/sample-task-plugin-update-by-query": ["x-pack/test/task_manager_claimer_update_by_query/plugins/sample_task_plugin_mget"],

x-pack/test/api_integration/deployment_agnostic/default_configs/stateful.config.base.ts

@@ -22,6 +22,7 @@ import {
 import path from 'path';
 import { REPO_ROOT } from '@kbn/repo-info';
 import { STATEFUL_ROLES_ROOT_PATH } from '@kbn/es';
+import { IDP_METADATA_PATHS, pluginPath as samlIdPPlugin } from '@kbn/saml-provider-plugin';
 import { dockerImage } from '../../../fleet_api_integration/config.base';
 import { DeploymentAgnosticCommonServices, services } from '../services';
 
@@ -61,15 +62,6 @@ export function createStatefulTestConfig<T extends DeploymentAgnosticCommonServi
 
     const xPackAPITestsConfig = await readConfigFile(require.resolve('../../config.ts'));
 
-    // TODO: move to kbn-es because currently metadata file has hardcoded entityID and Location
-    const idpPath = require.resolve(
-      '@kbn/security-api-integration-helpers/saml/idp_metadata_mock_idp.xml'
-    );
-    const samlIdPPlugin = path.resolve(
-      __dirname,
-      '../../../security_api_integration/plugins/saml_provider'
-    );
-
     const servers = {
       kibana: {
         ...kbnTestConfig.getUrlParts(systemIndicesSuperuser),
@@ -109,7 +101,7 @@ export function createStatefulTestConfig<T extends DeploymentAgnosticCommonServi
           ...xPackAPITestsConfig.get('esTestCluster.serverArgs'),
           'xpack.security.authc.token.enabled=true',
           `xpack.security.authc.realms.saml.${MOCK_IDP_REALM_NAME}.order=0`,
-          `xpack.security.authc.realms.saml.${MOCK_IDP_REALM_NAME}.idp.metadata.path=${idpPath}`,
+          `xpack.security.authc.realms.saml.${MOCK_IDP_REALM_NAME}.idp.metadata.path=${IDP_METADATA_PATHS.mockIdpPlugin}`,
           `xpack.security.authc.realms.saml.${MOCK_IDP_REALM_NAME}.idp.entity_id=${MOCK_IDP_ENTITY_ID}`,
           `xpack.security.authc.realms.saml.${MOCK_IDP_REALM_NAME}.sp.entity_id=${kbnUrl}`,
           `xpack.security.authc.realms.saml.${MOCK_IDP_REALM_NAME}.sp.acs=${kbnUrl}/api/security/saml/callback`,

x-pack/test/cloud_integration/config.ts

@@ -24,10 +24,11 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
     require.resolve('@kbn/test-suites-src/functional/config.base')
   );
 
-  const kibanaPort = kibanaFunctionalConfig.get('servers.kibana.port');
   const idpPath = resolve(__dirname, './plugins/saml_provider/metadata.xml');
   const samlIdPPlugin = resolve(__dirname, './plugins/saml_provider');
 
+  const kibanaPort = kibanaFunctionalConfig.get('servers.kibana.port');
+
   return {
     testFiles: [...(RUN_FULLSTORY_TESTS ? [resolve(__dirname, './tests/fullstory')] : [])],
 

x-pack/test/functional_cloud/config.ts

@@ -4,18 +4,14 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import { resolve } from 'path';
+
 import { FtrConfigProviderContext } from '@kbn/test';
+import { IDP_METADATA_PATHS, pluginPath as samlIdPPlugin } from '@kbn/saml-provider-plugin';
 
 export default async function ({ readConfigFile }: FtrConfigProviderContext) {
   const functionalConfig = await readConfigFile(require.resolve('../functional/config.base.js'));
 
   const kibanaPort = functionalConfig.get('servers.kibana.port');
-  const idpPath = resolve(
-    __dirname,
-    '../security_api_integration/plugins/saml_provider/metadata.xml'
-  );
-  const samlIdPPlugin = resolve(__dirname, '../security_api_integration/plugins/saml_provider');
 
   return {
     ...functionalConfig.getAll(),
@@ -31,7 +27,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
         ...functionalConfig.get('esTestCluster.serverArgs'),
         'xpack.security.authc.token.enabled=true',
         'xpack.security.authc.realms.saml.cloud-saml-kibana.order=0',
-        `xpack.security.authc.realms.saml.cloud-saml-kibana.idp.metadata.path=${idpPath}`,
+        `xpack.security.authc.realms.saml.cloud-saml-kibana.idp.metadata.path=${IDP_METADATA_PATHS.default}`,
         'xpack.security.authc.realms.saml.cloud-saml-kibana.idp.entity_id=http://www.elastic.co/saml1',
         `xpack.security.authc.realms.saml.cloud-saml-kibana.sp.entity_id=http://localhost:${kibanaPort}`,
         `xpack.security.authc.realms.saml.cloud-saml-kibana.sp.logout=http://localhost:${kibanaPort}/logout`,

x-pack/test/security_api_integration/login_selector.config.ts

@@ -9,6 +9,7 @@ import { readFileSync } from 'fs';
 import { resolve } from 'path';
 
 import { CA_CERT_PATH, KBN_CERT_PATH, KBN_KEY_PATH } from '@kbn/dev-utils';
+import { IDP_METADATA_PATHS } from '@kbn/saml-provider-plugin';
 import type { FtrConfigProviderContext } from '@kbn/test';
 
 export default async function ({ readConfigFile }: FtrConfigProviderContext) {
@@ -32,13 +33,6 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
     '@kbn/security-api-integration-helpers/pki/kibana_ca.crt'
   );
 
-  const saml1IdPMetadataPath = require.resolve(
-    '@kbn/security-api-integration-helpers/saml/idp_metadata.xml'
-  );
-  const saml2IdPMetadataPath = require.resolve(
-    '@kbn/security-api-integration-helpers/saml/idp_metadata_2.xml'
-  );
-
   const servers = {
     ...xPackAPITestsConfig.get('servers'),
     elasticsearch: {
@@ -80,7 +74,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
         'xpack.security.authc.realms.pki.pki1.delegation.enabled=true',
         `xpack.security.authc.realms.pki.pki1.certificate_authorities=${CA_CERT_PATH}`,
         'xpack.security.authc.realms.saml.saml1.order=3',
-        `xpack.security.authc.realms.saml.saml1.idp.metadata.path=${saml1IdPMetadataPath}`,
+        `xpack.security.authc.realms.saml.saml1.idp.metadata.path=${IDP_METADATA_PATHS.saml1}`,
         'xpack.security.authc.realms.saml.saml1.idp.entity_id=http://www.elastic.co/saml1',
         `xpack.security.authc.realms.saml.saml1.sp.entity_id=http://localhost:${kibanaPort}`,
         `xpack.security.authc.realms.saml.saml1.sp.logout=http://localhost:${kibanaPort}/logout`,
@@ -100,7 +94,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
         `xpack.security.authc.realms.oidc.oidc1.claims.principal=sub`,
         `xpack.security.authc.realms.oidc.oidc1.ssl.certificate_authorities=${CA_CERT_PATH}`,
         'xpack.security.authc.realms.saml.saml2.order=5',
-        `xpack.security.authc.realms.saml.saml2.idp.metadata.path=${saml2IdPMetadataPath}`,
+        `xpack.security.authc.realms.saml.saml2.idp.metadata.path=${IDP_METADATA_PATHS.saml2}`,
         'xpack.security.authc.realms.saml.saml2.idp.entity_id=http://www.elastic.co/saml2',
         `xpack.security.authc.realms.saml.saml2.sp.entity_id=http://localhost:${kibanaPort}`,
         `xpack.security.authc.realms.saml.saml2.sp.logout=http://localhost:${kibanaPort}/logout`,

x-pack/test/security_api_integration/packages/helpers/tsconfig.json

@@ -14,6 +14,5 @@
     "target/**/*"
   ],
   "kbn_references": [
-    "@kbn/dev-utils",
   ]
 }

x-pack/test/security_api_integration/saml.config.ts

@@ -7,6 +7,7 @@
 
 import { resolve } from 'path';
 
+import { IDP_METADATA_PATHS } from '@kbn/saml-provider-plugin';
 import type { FtrConfigProviderContext } from '@kbn/test';
 
 import { services } from './services';
@@ -15,7 +16,6 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
   const xPackAPITestsConfig = await readConfigFile(require.resolve('../api_integration/config.ts'));
 
   const kibanaPort = xPackAPITestsConfig.get('servers.kibana.port');
-  const idpPath = require.resolve('@kbn/security-api-integration-helpers/saml/idp_metadata.xml');
 
   const testEndpointsPlugin = resolve(__dirname, '../security_functional/plugins/test_endpoints');
 
@@ -37,7 +37,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
         'xpack.security.authc.token.enabled=true',
         'xpack.security.authc.token.timeout=15s',
         'xpack.security.authc.realms.saml.saml1.order=0',
-        `xpack.security.authc.realms.saml.saml1.idp.metadata.path=${idpPath}`,
+        `xpack.security.authc.realms.saml.saml1.idp.metadata.path=${IDP_METADATA_PATHS.saml1}`,
         'xpack.security.authc.realms.saml.saml1.idp.entity_id=http://www.elastic.co/saml1',
         `xpack.security.authc.realms.saml.saml1.sp.entity_id=http://localhost:${kibanaPort}`,
         `xpack.security.authc.realms.saml.saml1.sp.logout=http://localhost:${kibanaPort}/logout`,

x-pack/test/security_api_integration/saml.http2.config.ts

@@ -6,6 +6,7 @@
  */
 
 import { CA_CERT_PATH } from '@kbn/dev-utils';
+import { IDP_METADATA_PATHS } from '@kbn/saml-provider-plugin';
 import type { FtrConfigProviderContext } from '@kbn/test';
 import { configureHTTP2 } from '@kbn/test-suites-src/common/configure_http2';
 
@@ -14,7 +15,6 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
   const functionalConfig = await readConfigFile(require.resolve('./saml.config'));
 
   const kibanaPort = xPackAPITestsConfig.get('servers.kibana.port');
-  const idpPath = require.resolve('@kbn/security-api-integration-helpers/saml/idp_metadata.xml');
 
   return configureHTTP2({
     ...functionalConfig.getAll(),
@@ -25,7 +25,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
         'xpack.security.authc.token.enabled=true',
         'xpack.security.authc.token.timeout=15s',
         'xpack.security.authc.realms.saml.saml1.order=0',
-        `xpack.security.authc.realms.saml.saml1.idp.metadata.path=${idpPath}`,
+        `xpack.security.authc.realms.saml.saml1.idp.metadata.path=${IDP_METADATA_PATHS.saml1}`,
         'xpack.security.authc.realms.saml.saml1.idp.entity_id=http://www.elastic.co/saml1',
         `xpack.security.authc.realms.saml.saml1.sp.entity_id=https://localhost:${kibanaPort}`,
         `xpack.security.authc.realms.saml.saml1.sp.logout=https://localhost:${kibanaPort}/logout`,

x-pack/test/security_api_integration/saml_cloud.config.ts

@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { IDP_METADATA_PATHS } from '@kbn/saml-provider-plugin';
 import type { FtrConfigProviderContext } from '@kbn/test';
 
 import { services } from './services';
@@ -13,7 +14,6 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
   const xPackAPITestsConfig = await readConfigFile(require.resolve('../api_integration/config.ts'));
 
   const kibanaPort = xPackAPITestsConfig.get('servers.kibana.port');
-  const idpPath = require.resolve('@kbn/security-api-integration-helpers/saml/idp_metadata.xml');
 
   return {
     testFiles: [require.resolve('./tests/saml_cloud')],
@@ -31,7 +31,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
         'xpack.security.authc.token.enabled=true',
         'xpack.security.authc.token.timeout=15s',
         'xpack.security.authc.realms.saml.cloud-saml-kibana.order=0',
-        `xpack.security.authc.realms.saml.cloud-saml-kibana.idp.metadata.path=${idpPath}`,
+        `xpack.security.authc.realms.saml.cloud-saml-kibana.idp.metadata.path=${IDP_METADATA_PATHS.saml1}`,
         'xpack.security.authc.realms.saml.cloud-saml-kibana.idp.entity_id=http://www.elastic.co/saml1',
         `xpack.security.authc.realms.saml.cloud-saml-kibana.sp.entity_id=http://localhost:${kibanaPort}`,
         `xpack.security.authc.realms.saml.cloud-saml-kibana.sp.logout=http://localhost:${kibanaPort}/logout`,

x-pack/test/security_api_integration/session_concurrent_limit.config.ts

@@ -7,6 +7,7 @@
 
 import { resolve } from 'path';
 
+import { IDP_METADATA_PATHS } from '@kbn/saml-provider-plugin';
 import type { FtrConfigProviderContext } from '@kbn/test';
 
 import { services } from './services';
@@ -17,7 +18,6 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
   const xPackAPITestsConfig = await readConfigFile(require.resolve('../api_integration/config.ts'));
 
   const kibanaPort = xPackAPITestsConfig.get('servers.kibana.port');
-  const idpPath = require.resolve('@kbn/security-api-integration-helpers/saml/idp_metadata.xml');
 
   const testEndpointsPlugin = resolve(__dirname, '../security_functional/plugins/test_endpoints');
 
@@ -32,7 +32,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
         'xpack.security.authc.token.enabled=true',
         'xpack.security.authc.realms.native.native1.order=0',
         'xpack.security.authc.realms.saml.saml1.order=1',
-        `xpack.security.authc.realms.saml.saml1.idp.metadata.path=${idpPath}`,
+        `xpack.security.authc.realms.saml.saml1.idp.metadata.path=${IDP_METADATA_PATHS.saml1}`,
         'xpack.security.authc.realms.saml.saml1.idp.entity_id=http://www.elastic.co/saml1',
         `xpack.security.authc.realms.saml.saml1.sp.entity_id=http://localhost:${kibanaPort}`,
         `xpack.security.authc.realms.saml.saml1.sp.logout=http://localhost:${kibanaPort}/logout`,